Active Directory Domain Services EUVD-2026-73372

Exploitation requires a valid, low-privileged Active Directory domain user account (PR:L) with network connectivity to a domain controller running the AD DS role - conditions routinely met by any authenticated insider or post-phishing attacker. High attack complexity (AC:H) imposes a meaningful barrier: the UAF must be triggered under precise memory-state conditions, likely involving a race condition or heap-grooming sequence requiring repeated attempts or careful request ordering. Unauthenticated or anonymous network access is insufficient - the PR:L prerequisite is a hard gate. Systems not running the Active Directory Domain Services role are not directly exposed. There is no evidence of a required non-default configuration; any domain controller running AD DS across the broad affected version range is a candidate target once the credential and network access prerequisites are met.

The CVSS 7.5 score (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the tension between catastrophic impact and constrained exploitability. Full CIA compromise of a domain controller is in practice equivalent to full Active Directory domain compromise - one of the highest-consequence outcomes in enterprise security - yet AC:H meaningfully limits opportunistic exploitation. EPSS data is not provided in the input; the vulnerability is not confirmed in the CISA KEV catalog at time of analysis. No public exploit code has been identified. The PR:L requirement means exploitation is gatekept behind valid domain credentials, a realistic bar for insider threats or attacker post-phishing scenarios. The S:U (Unchanged scope) designation is technically correct under the CVSS model but understates real-world blast radius: code execution on a domain controller effectively grants domain-wide privilege to any attacker who achieves it. This is a genuine enterprise priority despite AC:H, because the consequence ceiling is catastrophic and low-privileged domain accounts are routinely obtainable.

An attacker who has obtained low-privileged domain credentials - through phishing, credential stuffing, or insider access - connects to a domain controller over the network and sends a sequence of specially crafted LDAP or RPC requests designed to trigger the use-after-free condition in AD DS. By carefully shaping heap allocation state across multiple requests (heap grooming), the attacker redirects execution to attacker-controlled data upon the freed pointer dereference, achieving code execution in the context of the AD DS service process. No public exploit code has been identified at time of analysis, but successful exploitation yields effective domain-wide administrative control.