CVE-2026-83667: Active Directory Domain Services DOS Vulnerability

CVE-2026-83667 Overview

CVE-2026-83667 is an out-of-bounds read vulnerability in Microsoft Active Directory Domain Services (AD DS). An authenticated attacker can send crafted network requests to a domain controller to trigger the condition and deny service to legitimate users. The flaw is classified under [CWE-125] Out-of-bounds Read and affects the availability of directory services across a Windows domain.

Successful exploitation does not expose confidential data or allow modification of directory objects. The impact is restricted to availability loss, which can still disrupt authentication, group policy processing, and dependent enterprise services.

Critical Impact
An authorized attacker with low privileges can remotely crash or hang AD DS components, interrupting domain authentication and services that depend on directory availability.

Affected Products

Microsoft Active Directory Domain Services (specific build list published in the vendor advisory)
Windows Server deployments running the AD DS role
Domain-joined environments relying on affected domain controllers for authentication

Discovery Timeline

2026-10-13 - CVE-2026-83667 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-83667

Vulnerability Analysis

The vulnerability is an out-of-bounds read inside Active Directory Domain Services. AD DS reads memory beyond the bounds of an allocated buffer while processing attacker-supplied input over the network. The read triggers abnormal process behavior that terminates or stalls directory service threads, producing a denial-of-service condition.

Because AD DS underpins authentication, authorization, and policy distribution, loss of a domain controller cascades into Kerberos ticket failures, LDAP query errors, and Group Policy processing issues. The vulnerability requires authentication, so an attacker must first obtain valid domain credentials or compromise an existing account. Full technical details are available in the Microsoft Security Update Guide for CVE-2026-83667.

Root Cause

The root cause is missing or insufficient bounds validation on a parsed field within an AD DS network request. When the service dereferences a length or offset derived from attacker-controlled data, it reads past the end of the allocated buffer and encounters an invalid memory region, causing a fault.

Attack Vector

The attack vector is network-based with low attack complexity. An attacker authenticated to the domain can reach the vulnerable AD DS network interfaces (typically LDAP, RPC, or related directory ports) and transmit a crafted request. No user interaction is required, and the attack scope is unchanged. Repeated exploitation can keep the directory service unavailable until administrators restore the affected domain controller.

No verified public proof-of-concept code is available at the time of publication. Refer to the vendor advisory for the authoritative technical description.

Detection Methods for CVE-2026-83667

Indicators of Compromise

Unexpected lsass.exe or NTDS service crashes recorded in the System and Application event logs on domain controllers
Repeated LDAP or RPC client disconnects followed by directory service restarts
Spikes in authentication failures across the domain correlated with domain controller unavailability

Detection Strategies

Monitor Windows event IDs related to AD DS service stop/start events (for example, Directory Service event IDs 1000, 1004, 1168) on all domain controllers
Alert on anomalous LDAP or RPC request volumes from a single authenticated principal to a domain controller
Correlate domain controller process crashes with network session metadata to identify the originating account and host

Monitoring Recommendations

Forward domain controller security, system, and directory service logs to a centralized analytics platform for cross-DC correlation
Baseline normal LDAP and RPC traffic patterns per account to surface outliers consistent with abuse
Track domain controller availability and replication health as a leading indicator of denial-of-service activity

How to Mitigate CVE-2026-83667

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-83667 to all domain controllers
Prioritize patching domain controllers exposed to broader network segments or non-admin user populations
Audit domain accounts for weak credentials and enforce multi-factor authentication where supported to raise the bar for the required authenticated access

Patch Information

Microsoft has released a security update that corrects the bounds validation in Active Directory Domain Services. Review the Microsoft Security Update Guide for CVE-2026-83667 for KB article references, affected builds, and installation guidance. Reboot domain controllers in a staged manner after installation to maintain directory availability.

Workarounds

Restrict network reachability to AD DS ports (LDAP 389/636, Global Catalog 3268/3269, RPC endpoint mapper 135, and dynamic RPC ports) to trusted administrative segments
Disable or remove inactive domain accounts to reduce the pool of credentials an attacker could abuse to meet the authenticated access requirement
Deploy multiple domain controllers per site and verify replication health so service can fail over if a single DC is disrupted

bash

# Example: query domain controller patch state for the update that fixes CVE-2026-83667
# Replace KBXXXXXXX with the KB number listed in the MSRC advisory
Get-HotFix -ComputerName (Get-ADDomainController -Filter *).HostName |
    Where-Object { $_.HotFixID -eq 'KBXXXXXXX' } |
    Select-Object PSComputerName, HotFixID, InstalledOn