Windows LDAP EUVD-2026-56381

The victim Windows system must initiate an LDAP connection - the attacker exploits the client-side parsing of LDAP server responses, not inbound LDAP requests to the victim. User interaction required (UI:R per CVSS) means a user or system process must trigger an LDAP query directed toward the attacker's server; in Active Directory environments this can occur during logon, policy refresh, or LDAP-enabled application activity. The attacker requires no authentication on the victim system (PR:N) and no special privileges. Exploitation is limited by the need to intercept or redirect LDAP traffic to an attacker-controlled server - requiring a man-in-the-middle position, DNS/NBNS poisoning capability, or user-initiated connection to an attacker-hosted LDAP endpoint. Non-default scenarios that increase exposure: environments where clients resolve LDAP servers via untrusted DNS, or applications that query external LDAP directories. Standard domain-joined clients querying only known DCs on an isolated internal segment are less exposed.

The CVSS 8.8 score reflects a genuinely dangerous profile: network-accessible (AV:N), low complexity (AC:L), no attacker privileges required (PR:N), and full C/I/A impact. The sole limiting factor is UI:R - a user or process on the target system must initiate an LDAP connection. In Active Directory environments, LDAP connections are routine and can be induced via phishing, DNS poisoning, or compromised internal servers, making UI:R a moderate rather than strong barrier. EPSS data is not present in the input; given the absence of KEV status and no confirmed POC, opportunistic mass exploitation is not confirmed. However, the automation potential is medium-high once a victim system is directed toward an attacker's LDAP server. The breadth of affected Windows versions - covering essentially every supported and several end-of-life Windows release - means patching surface is enormous. Real-world priority: HIGH for organizations with Active Directory or any Windows clients performing LDAP queries to external or potentially untrusted sources.

An attacker positions a rogue LDAP server on the network - via ARP spoofing, DNS poisoning, or a compromised internal host - and waits for a Windows client to perform an LDAP query, such as during domain authentication or group policy refresh. The malicious server responds with a crafted LDAP message containing an oversized payload, triggering the heap buffer overflow in the Windows LDAP client library and enabling arbitrary code execution in the context of the process performing the query. No public exploit code has been identified at time of analysis, but the low attack complexity rating suggests that once a working proof of concept is developed, exploitation would be straightforward for skilled attackers.