Windows LDAP EUVD-2026-56388

Exploitation requires the victim Windows system to establish an LDAP connection to an attacker-controlled server - this is the user interaction (UI:R) that the CVSS vector reflects. The attacker must be able to induce this connection, for example by manipulating DNS resolution, serving a malicious referral during an existing directory lookup, or persuading a user to visit a page that triggers an LDAP query. No authentication is required on the attacker's side (PR:N). The attacker must be positioned to respond to the victim's LDAP request with a crafted payload. Exploitation is limited by the need for the victim to initiate the LDAP session toward the attacker - purely passive, unsolicited network exploitation without some form of interaction or redirection is not indicated by the available data. Systems that do not make outbound LDAP connections to untrusted endpoints have significantly reduced exposure.

The CVSS base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects this as a serious but not fully weaponizable-without-interaction vulnerability. The PR:N metric indicates the attacker requires no credentials on their side, but UI:R is a meaningful limiting factor - exploitation requires inducing a Windows system to connect to an attacker-controlled LDAP endpoint. In enterprise environments, this could be triggered via phishing, DNS poisoning, or MitM on LDAP traffic, but it is not a fire-and-forget worm vector. No EPSS score was provided in the input data and this CVE does not appear in the CISA KEV catalog as of analysis time, reducing urgency relative to confirmed-exploited Microsoft vulnerabilities. However, the ubiquitous deployment of Windows across all versions from 2012 Server through Windows 11 25H2, the low attack complexity (AC:L), and the full-triad (C/H/I:H/A:H) impact collectively elevate this above typical high-CVSS-low-real-risk cases. The tags include 'Denial Of Service', suggesting the vulnerability may have multiple exploitation outcomes beyond code execution. Prioritize patching on systems that initiate LDAP connections to external or untrusted directories.

An attacker establishes a rogue LDAP server on a network reachable by the target Windows host. Through phishing, a malicious intranet page, or DNS poisoning, the attacker induces the victim's Windows system to initiate an LDAP query to the rogue server. The server returns a maliciously crafted LDAP response that triggers the use-after-free in the Windows LDAP client library, corrupting heap memory and redirecting execution to attacker-controlled shellcode, resulting in arbitrary code execution within the context of the process initiating the LDAP request. No public exploit identified at time of analysis.