Windows Active Directory: Remote code execution via stack-based buffer overflow

Summary

A stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over the network, according to the CVE record (CWE-121). The attack requires a valid low-privileged domain account and high attack complexity. Successful exploitation would give code execution with high impact on confidentiality, integrity and availability, which is serious on a domain controller.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846, per third-party source only; verify with MSRC)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)
• Windows Server 2025: unverified, listed by a third-party source only

Fixed in

• November 2026 Windows security updates (published 10 Nov 2026), installing the listed builds or later
• KB numbers: Unknown. Confirm them in the MSRC Security Update Guide before rollout.

Workaround

Unknown. No vendor workaround was found; patching is the only remedy identified.

• Interim measures (general hardening, not vendor-documented): restrict network access to domain controllers and limit low-privileged domain accounts.

Exploitation

• Not known to be exploited in the wild for this CVE. The exploited bug in the November 2026 release is reported as CVE-2026-124194.
• No public proof-of-concept found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Temporal metrics: exploit code maturity unproven (E:U), report confidence confirmed (RC:C).

Our recommendation

• Check the MSRC advisory and confirm the KB and build numbers for every domain controller and member server.
• Patch domain controllers first, then other Windows servers and clients.
• Until patched, restrict which hosts can reach domain controllers and review privileged and low-privileged account hygiene.
• Check that CVE-2026-45648, a similar CWE-121 flaw in AD DS from June 2026, is also patched.
• Recheck NVD and CISA KEV for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Ghost-Bx1/cve-2026-119948-windows-ad-rce

Research sources

• MSRC Security Update Guide: CVE-2026-119948 msrc.microsoft.com
• CVE.org CNA record CVE-2026-119948 www.cve.org
• Strix: CVE-2026-119948 (third-party, unverified) www.strix.ai
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Talos: Microsoft Patch Tuesday November 2026 blog.talosintelligence.com
• NTCompatible: November 2026 Patch Tuesday www.ntcompatible.com
• MSRC Security Update Guide: CVE-2026-45648 (related CWE-121 in AD DS) msrc.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:26.