Active Directory Domain Services EUVD-2026-73231

Exploitation requires a locally authenticated session with at least low-privilege credentials (PR:L) - any valid domain or local Windows account satisfies this. The attack vector is local (AV:L), so the attacker must be able to run code on the target system, either via interactive logon, Remote Desktop Protocol, a compromised service, or lateral movement. No user interaction is required beyond the attacker's own actions (UI:N). There is no indication from the description or CVSS vector that a non-default configuration is required; the vulnerability appears to exist in the default AD DS service. Limiting factors: requires an authenticated session on the host (no remote unauthenticated path), restricted to local privilege escalation (S:U - no direct cross-host scope change from the vulnerability itself), and only applicable to Windows builds running AD DS within the specified version ranges.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local privilege escalation with low attack complexity and no user interaction requirement - a straightforward, repeatable LPE class. The low privileges prerequisite (PR:L) means any domain or local user account with interactive or remote desktop access can trigger the vulnerability. EPSS data is not provided; given the absence of KEV listing and public PoC, opportunistic mass exploitation is unlikely at this time, but targeted use in post-compromise escalation chains is a realistic near-term risk. The lack of scope change (S:U) means the immediate impact is bounded to the compromised host; however, in AD DS environments, local SYSTEM on a domain-joined host can cascade to domain-wide compromise via credential extraction. The wide version range (fifteen distinct Windows builds) increases the aggregate attack surface substantially. Overall, this is a real patching priority in enterprise environments despite the absence of confirmed active exploitation.

An attacker who has compromised a low-privilege domain user account - for example through phishing or credential stuffing - logs on locally or via RDP to a Windows domain-joined server or domain controller. The attacker invokes a crafted call to the vulnerable AD DS component, triggering the heap-based buffer overflow, and corrupts heap control structures to redirect execution to shellcode, achieving SYSTEM-level code execution on the host. No public exploit code has been identified at time of analysis, but the low complexity (AC:L) suggests the exploitation path is straightforward once the overflow offset is determined.