---
id: "CVE-2026-119958"
page: "https://infrastack.ai/live/CVE-2026-119958"
kind: "vulnerability"
aliases: ["CVE-2026-119958"]
title: "Windows LDAP: out-of-bounds write allows unauthenticated remote code execution (CVSS 9.8)"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": "< 10.0.26100.33822", "ecosystem": "microsoft"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": "< 10.0.20348.5870", "ecosystem": "microsoft"}, {"name": "Windows Server 2019", "fixed": ["10.0.17763.9487"], "affected": "< 10.0.17763.9487", "ecosystem": "microsoft"}, {"name": "Windows Server 2016", "fixed": ["10.0.14393.9688"], "affected": "< 10.0.14393.9688", "ecosystem": "microsoft"}, {"name": "Windows 11 24H2/25H2", "fixed": ["10.0.26100.9974", "10.0.26200.9974"], "affected": "< 10.0.26100.9974 (24H2), < 10.0.26200.9974 (25H2)", "ecosystem": "microsoft"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": "< 10.0.22631.7711", "ecosystem": "microsoft"}, {"name": "Windows 10 22H2/21H2", "fixed": ["10.0.19045.7846", "10.0.19044.7846"], "affected": "< 10.0.19045.7846 (22H2), < 10.0.19044.7846 (21H2)", "ecosystem": "microsoft"}]
ecosystems: []
tags: ["active-directory", "domain-controller", "infrastructure", "ldap", "pre-auth", "rce", "windows", "windows-server"]
not_affected_if: ["patched-build"]
published_at: "2026-11-10T19:20:19+00:00"
first_seen_at: "2026-11-10T19:25:05+00:00"
updated_at: "2026-11-10T19:32:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119958", "first_seen_at": "2026-11-10T19:25:05+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-119958", "first_seen_at": "2026-11-10T19:32:23+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-119958"]}]
exploit_sources: []
---

# Windows LDAP: out-of-bounds write allows unauthenticated remote code execution (CVSS 9.8)

Link for people: https://infrastack.ai/live/CVE-2026-119958 (this .md is for agents)

A memory write flaw in the Windows LDAP directory service lets an unauthorized attacker write past a buffer. The attacker can execute code on the affected Windows machine over the network.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- microsoft:Windows Server 2025 affected < 10.0.26100.33822 fixed 10.0.26100.33822
- microsoft:Windows Server 2022 affected < 10.0.20348.5870 fixed 10.0.20348.5870
- microsoft:Windows Server 2019 affected < 10.0.17763.9487 fixed 10.0.17763.9487
- microsoft:Windows Server 2016 affected < 10.0.14393.9688 fixed 10.0.14393.9688
- microsoft:Windows 11 24H2/25H2 affected < 10.0.26100.9974 (24H2), < 10.0.26200.9974 (25H2) fixed 10.0.26100.9974, 10.0.26200.9974
- microsoft:Windows 11 23H2 affected < 10.0.22631.7711 fixed 10.0.22631.7711
- microsoft:Windows 10 22H2/21H2 affected < 10.0.19045.7846 (22H2), < 10.0.19044.7846 (21H2) fixed 10.0.19045.7846, 10.0.19044.7846

## How to check

Run winver or [System.Environment]::OSVersion / Get-ComputerInfo on each domain controller and LDAP server and compare the OS build (major.UBR) with the fixed builds in the fix field. Prioritise domain controllers and AD LDS hosts reachable on TCP/UDP 389 and 636.

## Fix

Install the November 2026 Windows cumulative update. Per the Microsoft CVE record (via OpenCVE, unconfirmed on MSRC), fixed builds are: Server 2025 10.0.26100.33822, Server 2022 10.0.20348.5870, Server 2019 / Win10 1809 10.0.17763.9487, Server 2016 / Win10 1607 10.0.14393.9688, Win10 21H2/22H2 10.0.19044.7846 / 10.0.19045.7846, Win11 23H2 10.0.22631.7711, Win11 24H2/25H2 10.0.26100.9974 / 10.0.26200.9974, Win11 26H1 10.0.28000.3501, 26H2 10.0.26300.9974.

## Timeline

- 2026-11-10T19:25:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119958
- 2026-11-10T19:32:23+00:00 analyst https://app.opencve.io/cve/CVE-2026-119958 — MSRC page is JS-only and not readable; build ranges come from the Microsoft CNA record as mirrored by OpenCVE (not primary), so nothing verified. No exploitation or PoC found. Revisit when MSRC text is available to confirm builds, workarounds and any LDAP-specific preconditions.

## Documents

- [describes] OpenCVE: CVE-2026-119958 (mirror of Microsoft CVE record) https://app.opencve.io/cve/CVE-2026-119958

## From the sources

Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_