CVE-2026-49164

What it actually does

This vulnerability is a heap-based buffer overflow in Active Directory Domain Services reachable over the network by an unauthenticated attacker. If successfully triggered, malformed directory-service traffic can corrupt heap memory in the AD DS process context, potentially allowing remote code execution with the privileges of the service, commonly within LSASS on a domain controller. Because AD DS is central to authentication, successful exploitation could provide high-impact confidentiality, integrity, and availability compromise. The CVSS vector indicates no authentication or user interaction is required, but exploitation complexity is high, meaning reliable exploitation may depend on precise memory layout, service state, protocol behavior, or environmental conditions.

Why it matters to the business

A successful attack against a domain controller could give an attacker control over identity infrastructure, enabling theft or manipulation of credentials, creation or modification of accounts, disruption of authentication, lateral movement, and broad compromise of Windows environments. Even failed exploitation attempts may crash AD DS or LSASS, causing domain controller instability and login or access failures. The issue is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has low EPSS at 0.00649 with no public exploit maturity reported, but the business risk remains significant because domain controllers are high-value assets and the vulnerability has been public for 28 days.

How an attack unfolds

An attacker first identifies an exposed or reachable domain controller or Windows host running Active Directory Domain Services. They then send specially crafted network traffic to the AD DS service interface designed to trigger unsafe heap memory handling. If the crafted input reaches the vulnerable code path and heap conditions are favorable, memory corruption occurs. A failed attempt may result in LSASS or AD DS service crashes and domain controller instability. A successful attempt could allow attacker-controlled code to execute in the service context, after which the attacker would typically attempt to gain control of directory services, dump or abuse credentials, create persistence through directory changes, and move laterally to systems that trust the domain.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows and Windows Server versions, prioritizing domain controllers first. Because no exact fixed build numbers were provided, use Microsoft’s official update guidance for the July 2026 security release or the first cumulative/security update that explicitly lists this vulnerability as fixed. Ensure all supported affected versions are patched, including Windows Server 2012, 2016, 2019, 2022, 2025, Windows 10 1607/1809/21H2/22H2, and Windows 11 24H2/25H2/26H1 where AD DS components are present. If immediate patching is not possible, reduce exposure by restricting network access to domain controllers to trusted administrative and domain-member networks, blocking unnecessary inbound access to AD-related services from untrusted segments, monitoring for LSASS instability, and ensuring domain controllers are not internet-exposed. Maintain backups of Active Directory and system state, and verify domain controller recovery procedures.

How to confirm the fix worked

Confirm that each affected system has installed the Microsoft cumulative or security update that remediates this vulnerability. Validate patch deployment through centralized patch inventory, Windows Update history, Microsoft Defender Vulnerability Management, WSUS/SCCM/Intune reporting, or equivalent endpoint management tooling. On domain controllers, confirm the OS build and installed KB level match Microsoft’s fixed release guidance. Validate exposure by enumerating domain controllers and checking whether AD DS ports are reachable only from expected internal networks. After patching, monitor for normal AD DS operation, absence of recurring LSASS crashes, and successful authentication/replication health checks using standard Active Directory health validation such as dcdiag, repadmin, and event log review.

Typical attack path

1. Discover domain controllers or AD DS-exposed systems reachable over the network.
2. Probe directory-service ports and behavior to confirm AD DS availability and version exposure.
3. Send malformed AD DS protocol traffic intended to trigger the heap-based buffer overflow.
4. Achieve memory corruption; failed attempts may crash LSASS or AD DS services.
5. If code execution succeeds, run attacker-controlled code in the AD DS service context.
6. Abuse directory privileges to access credentials, modify accounts or groups, establish persistence, and move laterally across the domain.

How to detect it

Hunt for evidence of exploitation attempts or successful compromise on domain controllers and systems running AD DS. Review Windows System, Application, Security, Directory Service, and LSASS-related logs for crashes, service restarts, or abnormal failures around inbound directory-service traffic. Pay particular attention to Application Error or Windows Error Reporting events involving lsass.exe, ntdsai.dll, ntdsa.dll, wldap32.dll, schannel.dll, or other AD DS-related modules. Correlate crash times with network telemetry showing unusual LDAP, LDAPS, Kerberos, SMB/RPC, or Global Catalog traffic from unauthenticated, unmanaged, or unexpected source IPs. Look for post-exploitation behavior on domain controllers, including credential dumping attempts, suspicious child processes spawned from LSASS or service hosts, new privileged accounts, changes to Domain Admins or equivalent groups, abnormal directory replication requests, and unexpected remote administration activity. Since no public exploit indicators or actor-specific artifacts are available, detection should focus on protocol anomalies, LSASS/AD DS instability, and identity-control-plane changes after suspicious inbound traffic.

• lsass.exe
• ntdsai.dll
• ntdsa.dll
• Event ID 1000
• Event ID 1001
• Faulting application name: lsass.exe
• Windows Error Reporting
• The Local Security Authority process terminated unexpectedly
• The Active Directory Domain Services service terminated unexpectedly
• NTDS
• Directory Service
• LDAP
• LDAPS
• TCP/389
• TCP/636
• TCP/3268
• TCP/3269
• TCP/88
• TCP/445
• TCP/135

What your security team should do

• Prioritize patching all domain controllers and AD DS hosts ahead of lower-risk endpoints because compromise of identity infrastructure can enable enterprise-wide impact.
• Use network controls to limit access to AD DS services to trusted internal systems and administrative networks; block access from untrusted networks and the internet.
• Review logs for LSASS crashes, abnormal AD DS service failures, and unexpected inbound directory-service traffic during the period since publication.
• Increase monitoring on domain controllers for suspicious account creation, group membership changes, privilege escalation, credential dumping behavior, and unusual replication activity.
• Ensure domain controller system-state backups are current, protected from tampering, and restorable.
• Run an authenticated vulnerability or patch compliance scan after remediation to verify no affected systems remain unpatched.
• Because public exploit maturity is currently reported as none and EPSS is low, align emergency response with exposure: treat internet-reachable or broadly reachable domain controllers as urgent, and internally segmented systems as high-priority scheduled remediation.