CVE-2026-49164: Windows 10 1607 Buffer Overflow Flaw

CVE-2026-49164 Overview

CVE-2026-49164 is a heap-based buffer overflow vulnerability in Microsoft Active Directory Domain Services (AD DS). The flaw allows an unauthenticated remote attacker to execute arbitrary code over the network without user interaction. Microsoft assigned this vulnerability a CVSS 3.1 score of 9.8, reflecting the impact on confidentiality, integrity, and availability of affected domain controllers. The vulnerability is tracked under CWE-122, Heap-based Buffer Overflow. Because domain controllers are typically reachable from all internal endpoints and provide authentication services across the enterprise, successful exploitation can lead to full domain compromise.

Critical Impact
An unauthenticated network attacker can execute arbitrary code on Windows domain controllers, enabling full Active Directory takeover and lateral movement across the enterprise.

Affected Products

Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2
Microsoft Windows 11 versions 24H2, 25H2, and 26H1

Discovery Timeline

2026-07-14 - CVE-2026-49164 published to the National Vulnerability Database
2026-07-16 - Last updated in the NVD database

Technical Details for CVE-2026-49164

Vulnerability Analysis

CVE-2026-49164 resides in the Active Directory Domain Services component of Windows, which handles authentication and directory services for domain-joined systems. The flaw is a heap-based buffer overflow, meaning a memory region allocated on the heap is written past its intended bounds. An attacker who can reach an exposed AD DS network service can trigger the overflow without valid credentials and without any user interaction on the target. Successful exploitation grants code execution in the context of the AD DS service, which typically runs with high privileges on a domain controller.

Root Cause

The root cause is improper validation of input lengths or sizes before copying attacker-controlled data into a heap-allocated buffer within AD DS request handling. When the crafted payload exceeds the target buffer, adjacent heap metadata and objects are overwritten. Microsoft has not disclosed the specific function or protocol handler at fault; refer to the Microsoft Security Update Guide entry for CVE-2026-49164 for authoritative technical details.

Attack Vector

Exploitation requires only network access to the vulnerable AD DS service. The attack complexity is low, no privileges are required, and no user interaction is needed. An attacker who has established a foothold on any domain-joined workstation can pivot to unauthenticated exploitation of a domain controller from within the same network segment. Because domain controllers are core to enterprise trust, code execution on a DC is equivalent to full Active Directory compromise.

Detection Methods for CVE-2026-49164

Indicators of Compromise

Unexpected crashes, restarts, or watchdog events for the lsass.exe or NTDS service on domain controllers.
Anomalous inbound network traffic to AD DS ports (389/tcp LDAP, 636/tcp LDAPS, 88/tcp Kerberos, 445/tcp SMB, 3268/tcp GC) from non-administrative hosts.
New or unusual child processes spawned by AD DS service processes on domain controllers.
Creation of new privileged accounts, group memberships, or Group Policy objects that do not correspond to a change ticket.

Detection Strategies

Enable Windows Defender Exploit Guard and audit crash telemetry on all domain controllers for signs of heap corruption in AD DS binaries.
Correlate Windows Event IDs 1000 (application error) and 7031/7034 (service crash) for AD DS components with concurrent network activity.
Baseline legitimate LDAP and RPC traffic to domain controllers and alert on volumetric or malformed request anomalies.

Monitoring Recommendations

Continuously monitor Active Directory replication health and directory object changes for tampering following any suspected exploitation attempt.
Track authentication anomalies including Kerberos ticket requests from unusual sources and creation of high-privilege accounts.
Forward domain controller security, system, and directory service logs to a centralized SIEM for retention and correlation.

How to Mitigate CVE-2026-49164

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-49164 to all domain controllers and affected Windows client systems.
Prioritize patching internet-adjacent and multi-tenant domain controllers first, followed by tier-0 assets in every AD forest.
Audit domain controllers for unauthorized changes, new privileged accounts, and unexpected service crashes prior to and after patching.

Patch Information

Microsoft has released security updates for all affected versions of Windows and Windows Server through the Microsoft Security Update Guide. Administrators should deploy the update via Windows Update, Windows Server Update Services (WSUS), Microsoft Configuration Manager, or Intune. Refer to the Microsoft Security Update Guide entry for CVE-2026-49164 for KB article numbers matched to each build.

Workarounds

Restrict inbound network access to domain controller service ports using host-based firewalls and network segmentation, permitting only required client subnets and management hosts.
Enforce LDAP signing and channel binding to reduce the exposure of directory service endpoints to untrusted clients until patches are applied.
Isolate legacy Windows Server 2012 and 2012 R2 domain controllers that are out of standard support and accelerate their retirement or Extended Security Update (ESU) coverage.

bash

# Example: restrict inbound access to AD DS ports on a domain controller
# to a management subnet using Windows Firewall (run as Administrator)
New-NetFirewallRule -DisplayName "Restrict LDAP to Mgmt" `
  -Direction Inbound -Protocol TCP -LocalPort 389,636,3268,3269 `
  -RemoteAddress 10.10.0.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Block LDAP from Others" `
  -Direction Inbound -Protocol TCP -LocalPort 389,636,3268,3269 `
  -Action Block