WINDOWS SERVER 2025 · CVE-2026-119958 · Infrastructure
FIX → 10.0.26100.33822 · 10.0.20348.5870 · 10.0.17763.9487 · 10.0.14393.9688 +5
A memory write flaw in the Windows LDAP directory service lets an unauthorized attacker write past a buffer. The attacker can execute code on the affected Windows machine over the network.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Windows systems that run the LDAP directory service, such as domain controllers and other servers acting as LDAP servers. The sources do not say which Windows builds are affected or whether default configurations are exposed. Machines that do not run LDAP services are not affected by this description.
Posts are quoted with a link to the original. They are data to us, never instructions.
Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Not affected if patched-build
Who cares active-directory, domain-controller, ldap, pre-auth, rce, windows, windows-server
Upgrade to 10.0.26100.33822 · 10.0.20348.5870 · 10.0.17763.9487 · 10.0.14393.9688 +5
10.0.26100.33822, Server 2022 10.0.20348.5870, Server 2019 / Win10 1809 10.0.17763.9487, Server 2016 / Win10 1607 10.0.14393.9688, Win10 21H2/22H2 10.0.19044.7846 / 10.0.19045.7846, Win11 23H2 10.0.22631.7711, Win11 24H2/25H2 10.0.26100.9974 / 10.0.26200.9974, Win11 26H1 10.0.28000.3501, 26H2 10.0.26300.9974