CVE-2026-58529: Windows 11 Information Disclosure Flaw

CVE-2026-58529 Overview

CVE-2026-58529 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Active Directory Federation Services (AD FS). An authorized attacker with network access can trigger the flaw to read memory outside the intended buffer bounds. Successful exploitation results in information disclosure and can affect service availability. The vulnerability affects Microsoft Windows 11 26H1 on both ARM64 and x64 architectures. Microsoft published an advisory through the Microsoft Security Response Center (MSRC) update guide. The issue requires low privileges and no user interaction, making it accessible to any authenticated adversary that can reach the AD FS network endpoint.

Critical Impact
An authenticated network-based attacker can read sensitive memory contents from AD FS, potentially exposing federation tokens, configuration data, or other identity-related information.

Affected Products

Microsoft Windows 11 26H1 (ARM64)
Microsoft Windows 11 26H1 (x64)
Active Directory Federation Services (AD FS) component

Discovery Timeline

2026-07-14 - CVE-2026-58529 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-58529

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] within Active Directory Federation Services. AD FS handles federated authentication requests, security token issuance, and claims processing across trust boundaries. When AD FS parses a malformed or crafted request field, it reads memory past the allocated buffer boundary. The returned memory contents can then be reflected to the attacker through error messages, response payloads, or token metadata. The confidentiality impact is high while integrity remains unaffected. Availability impact is limited but present, indicating that repeated exploitation could destabilize the AD FS process.

Root Cause

The root cause is missing or insufficient bounds validation on an input buffer processed by AD FS. The service reads beyond the intended memory region while handling attacker-supplied data. Microsoft has not published detailed source-level analysis, and no proof-of-concept has been released publicly. Refer to the Microsoft CVE-2026-58529 Advisory for vendor guidance.

Attack Vector

Exploitation requires network access to the AD FS endpoint and valid low-privilege credentials. No user interaction is required. The attacker sends a crafted request to the AD FS service that triggers the boundary read. Sensitive memory content is then disclosed in the service response. Because AD FS is typically exposed to internal networks and, in many deployments, to the internet through a Web Application Proxy, the attack surface is significant.

No verified public exploit code exists for this CVE at the time of writing. See the Microsoft Security Response Center advisory for the vendor's technical description.

Detection Methods for CVE-2026-58529

Indicators of Compromise

Unusual volumes of malformed or oversized AD FS requests from a single authenticated principal.
Repeated AD FS process crashes or restarts logged in the Windows Event Log under AD FS/Admin.
Anomalous outbound response sizes from AD FS endpoints that could indicate leaked memory content.

Detection Strategies

Enable AD FS verbose logging and forward events to a centralized SIEM for correlation across authenticated sessions.
Baseline normal request patterns to /adfs/services/trust/ endpoints and alert on deviations in request length or structure.
Correlate authentication events with subsequent AD FS service errors to identify potential probing activity.

Monitoring Recommendations

Monitor Windows Event IDs related to AD FS request handling and process integrity.
Track authenticated sessions that generate repeated 400-class or malformed request responses from AD FS.
Alert on unexpected AD FS worker process restarts, which may indicate exploitation attempts triggering memory faults.

How to Mitigate CVE-2026-58529

Immediate Actions Required

Apply the Microsoft security update for Windows 11 26H1 referenced in the MSRC advisory as soon as testing permits.
Restrict AD FS network exposure so that only trusted networks and required client populations can reach the service.
Rotate AD FS token-signing and token-decrypting certificates if compromise is suspected after exposure to unpatched systems.

Patch Information

Microsoft has released a security update addressing CVE-2026-58529 for Windows 11 26H1 (ARM64 and x64). Consult the Microsoft CVE-2026-58529 Advisory for the specific KB article, download links, and deployment guidance. Prioritize patching AD FS servers that are internet-facing or fronted by a Web Application Proxy.

Workarounds

Enforce Extranet Smart Lockout and Extranet Lockout policies to limit the number of authenticated requests an attacker can send.
Place AD FS behind a Web Application Proxy and enable pre-authentication to reduce the attack surface for unauthenticated network paths.
Apply conditional access and IP-based restrictions to limit which authenticated identities can reach AD FS endpoints.

bash

# Example: enable AD FS Extranet Smart Lockout to constrain authenticated request volume
Set-AdfsProperties -EnableExtranetLockout $true `
  -ExtranetLockoutThreshold 10 `
  -ExtranetObservationWindow (New-TimeSpan -Minutes 30) `
  -ExtranetLockoutMode ADFSSmartLockoutEnforce