{"id":"CVE-2026-119958","kind":"vulnerability","aliases":["CVE-2026-119958"],"related":[],"title":"Windows LDAP: out-of-bounds write allows unauthenticated remote code execution (CVSS 9.8)","description":"Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.","summary":"A memory write flaw in the Windows LDAP directory service lets an unauthorized attacker write past a buffer. The attacker can execute code on the affected Windows machine over the network.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 11 24H2/25H2","fixed":["10.0.26100.9974","10.0.26200.9974"],"affected":"< 10.0.26100.9974 (24H2), < 10.0.26200.9974 (25H2)","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 10 22H2/21H2","fixed":["10.0.19045.7846","10.0.19044.7846"],"affected":"< 10.0.19045.7846 (22H2), < 10.0.19044.7846 (21H2)","ecosystem":"microsoft"}],"ecosystems":[],"tags":["active-directory","domain-controller","infrastructure","ldap","pre-auth","rce","windows","windows-server"],"not_affected_if":["patched-build"],"how_to_check":"Run winver or [System.Environment]::OSVersion / Get-ComputerInfo on each domain controller and LDAP server and compare the OS build (major.UBR) with the fixed builds in the fix field. Prioritise domain controllers and AD LDS hosts reachable on TCP/UDP 389 and 636.","fix":"Install the November 2026 Windows cumulative update. Per the Microsoft CVE record (via OpenCVE, unconfirmed on MSRC), fixed builds are: Server 2025 10.0.26100.33822, Server 2022 10.0.20348.5870, Server 2019 / Win10 1809 10.0.17763.9487, Server 2016 / Win10 1607 10.0.14393.9688, Win10 21H2/22H2 10.0.19044.7846 / 10.0.19045.7846, Win11 23H2 10.0.22631.7711, Win11 24H2/25H2 10.0.26100.9974 / 10.0.26200.9974, Win11 26H1 10.0.28000.3501, 26H2 10.0.26300.9974.","status":"open","published_at":"2026-11-10T19:20:19+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","triaged_at":"2026-11-10T19:25:40+00:00","updated_at":"2026-11-10T19:32:23+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-11-10T19:25:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows LDAP: out-of-bounds write lets an attacker run code remotely","impact":"high","summary":"A memory write flaw in the Windows LDAP directory service lets an unauthorized attacker write past a buffer. The attacker can execute code on the affected Windows machine over the network.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","active-directory","ldap"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated remote code execution on Windows LDAP servers","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-119958 for affected Windows builds, the patch, and whether a workaround exists.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows systems that run the LDAP directory service, such as domain controllers and other servers acting as LDAP servers. The sources do not say which Windows builds are affected or whether default configurations are exposed. Machines that do not run LDAP services are not affected by this description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000674,"input_tokens":4512,"output_tokens":445,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-119958 for affected Windows builds, the patch, and whether a workaround exists.","search":"'-119958':17A,20A '-2026':16A,19A '10':40A '11':34A,37A '2016':32A '2019':29A '2022':26A '2025':23A '22h2/21h2':41A '23h2':38A '24h2/25h2':35A '9.8':14A 'access':99C 'activ':43B 'active-directori':42B 'affect':83B 'allow':8A,101C 'attack':71B,77B,104C 'auth':52B 'bound':6A,92C 'buffer':75B 'code':11A,80B,107C 'control':47B 'cve':15A,18A 'cvss':13A 'directori':44B,66B,98C 'domain':46B 'domain-control':45B 'execut':12A,79B,106C 'flaw':61B 'infrastructur':48B 'ldap':2A,49B,65B,96C 'let':68B 'lightweight':97C 'machin':85B 'memori':59B 'network':88B,110C 'out-of-bound':3A,89C 'past':73B 'pre':51B 'pre-auth':50B 'protocol':100C 'rce':53B 'remot':10A 'server':22A,25A,28A,31A,57B 'servic':67B 'unauthent':9A 'unauthor':70B,103C 'window':1A,54B,56B,64B,84B,95C 'windows':21A,24A,27A,30A,33A,36A,39A 'windows-serv':55B 'write':7A,60B,72B,93C","nicknames":[],"mitigations":[],"who_affected":"Windows systems that run the LDAP directory service, such as domain controllers and other servers acting as LDAP servers. The sources do not say which Windows builds are affected or whether default configurations are exposed. Machines that do not run LDAP services are not affected by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1022h221h2","1123h2","1124h225h2","server2016","server2019","server2022","server2025","windows1022h221h2","windows1123h2","windows1124h225h2","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["10","11","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","server","windows"],"labels":["activedirectory","critical","domaincontroller","infrastructure","ldap","preauth","rce","windows","windowsserver"],"campaign_type":null,"search_a":"'-119958':17A,20A '-2026':16A,19A '10':40A '11':34A,37A '2016':32A '2019':29A '2022':26A '2025':23A '22h2/21h2':41A '23h2':38A '24h2/25h2':35A '9.8':14A 'allow':8A 'bound':6A 'code':11A 'cve':15A,18A 'cvss':13A 'execut':12A 'ldap':2A 'out-of-bound':3A 'remot':10A 'server':22A,25A,28A,31A 'unauthent':9A 'window':1A 'windows':21A,24A,27A,30A,33A,36A,39A 'write':7A","search_b":"'activ':43B 'active-directori':42B 'affect':83B 'attack':71B,77B 'auth':52B 'buffer':75B 'code':80B 'control':47B 'directori':44B,66B 'domain':46B 'domain-control':45B 'execut':79B 'flaw':61B 'infrastructur':48B 'ldap':49B,65B 'let':68B 'machin':85B 'memori':59B 'network':88B 'past':73B 'pre':51B 'pre-auth':50B 'rce':53B 'server':57B 'servic':67B 'unauthor':70B 'window':54B,56B,64B,84B 'windows-serv':55B 'write':60B,72B","search_c":"'access':99C 'allow':101C 'attack':104C 'bound':92C 'code':107C 'directori':98C 'execut':106C 'ldap':96C 'lightweight':97C 'network':110C 'out-of-bound':89C 'protocol':100C 'unauthor':103C 'window':95C 'write':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119958","severity":null,"published_at":"2026-11-10T19:20:19+00:00","modified_at":"2026-11-10T19:20:19+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","fetched_at":"2026-11-10T19:25:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119958:2519","url":"https://app.opencve.io/cve/CVE-2026-119958","severity":null,"published_at":"2026-11-10T19:32:23+00:00","modified_at":"2026-11-10T19:32:23+00:00","first_seen_at":"2026-11-10T19:32:23+00:00","fetched_at":"2026-11-10T19:32:23+00:00","note":"MSRC page is JS-only and not readable; build ranges come from the Microsoft CNA record as mirrored by OpenCVE (not primary), so nothing verified. No exploitation or PoC found. Revisit when MSRC text is available to confirm builds, workarounds and any LDAP-specific preconditions.","cites":["https://app.opencve.io/cve/CVE-2026-119958"]}],"documents":[{"id":117573,"url":"https://app.opencve.io/cve/CVE-2026-119958","title":"OpenCVE: CVE-2026-119958 (mirror of Microsoft CVE record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}