EUVD-2026-43996
GHSA-gcv2-qw2g-r29w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable AD FS listener needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); a stack overflow crashes the service, so availability-only impact (A:H, C:N/I:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service in Microsoft Active Directory Federation Services (AD FS) allows a remote, unauthenticated attacker to crash the service by triggering a stack-based buffer overflow over the network (CVSS 7.5, availability-only impact). Because AD FS brokers single sign-on and federated authentication, a successful attack can knock out login for every downstream application that relies on it. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
The flaw is a stack-based buffer overflow (CWE-121), a memory-safety defect in which network-supplied data is copied into a fixed-size stack buffer without adequate bounds checking, corrupting the stack. It resides in AD FS, the Windows role that provides claims-based federated identity and single sign-on (SAML/WS-Federation/OAuth) across organizational boundaries. The affected CPE and tag data enumerate the full Windows Server line that can host the AD FS role - Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations) - while the additional Windows 10/11 client CPEs reflect Microsoft's shared servicing-stack update packaging rather than the client OS itself running AD FS. While CWE-121 buffer overflows can sometimes yield code execution, the CVSS vector here scores only availability impact (C:N/I:N/A:H), indicating the practical outcome is a service crash rather than compromise.
RemediationAI
Apply the Microsoft security update for CVE-2026-50695 as delivered through the monthly cumulative update for each affected Windows Server version; Patch available per vendor advisory (an exact fixed build number is not specified in the provided data, so obtain the precise KB from the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50695). As compensating controls until patching completes, restrict network reachability to the AD FS and Web Application Proxy endpoints - limit the federation service to trusted networks, place it behind the Web Application Proxy rather than exposing the AD FS servers directly, and use firewall rules or extranet smart lockout/geo-filtering to reduce the pool of hosts that can reach the vulnerable listener; the trade-off is that overly aggressive filtering can break legitimate external federated logins, so scope rules to known partner and client ranges. Ensure AD FS server redundancy (farm nodes behind a load balancer) so a single crashed node does not eliminate authentication availability.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today