Windows LDAP: Remote code execution via out-of-bounds write

Summary

A critical out-of-bounds write vulnerability in the Windows LDAP component allows an unauthenticated attacker to execute code over the network. The CVSS v3.1 base score is 9.8 (CWE-787). Windows LDAP runs on domain controllers and other Windows servers, so a successful attack could compromise authentication across the whole network. At publication the NVD record was still awaiting analysis, and details may change.

Affected

• Windows 10 Version 1607, 1809, 21H2, 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2
• Windows Server 2016 (including Server Core), 2019 (including Server Core), 2022
• Affected build ranges per the official CVE record: 10.0.14393.0 to < 10.0.14393.9688 (Windows 10 1607, Server 2016); 10.0.17763.0 to < 10.0.17763.9487 (1809, Server 2019); 10.0.19044.0 to < 10.0.19045.7846 (Windows 10 21H2 and 22H2); 10.0.20348.0 to < 10.0.20348.5870 (Server 2022); 10.0.22631.0 to < 10.0.22631.7711 (Windows 11 23H2); 10.0.26100.0 to < 10.0.26100.9974 (Windows 11 24H2); 10.0.26200.0 to < 10.0.26200.9974 (Windows 11 25H2); 10.0.28000.0 to < 10.0.28000.3501 (Windows 11 26H1); 10.0.26300.0 to < 10.0.26300.9974 (Windows 11 26H2)

Fixed in

Fixed builds and KB articles: Unknown. Verify in the MSRC advisory. The official record lists the upper bounds above as the first unaffected builds.

Workaround

Unknown. No vendor workaround was found in the sources. Do not apply guidance from related Windows LDAP CVEs without confirmation from MSRC.

Exploitation

• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• No public proof of concept or in-the-wild exploitation found at the time of research.

Our recommendation

• Open the MSRC advisory and confirm CVSS, CWE, affected builds and KB fixes.
• Inventory domain controllers and all LDAP/LDAPS services (ports 389/636) and remove any internet exposure or access from untrusted networks.
• Apply the vendor patch to all affected domain controllers and servers in the next maintenance window, earlier if exposure is confirmed or exploitation is reported.
• Monitor NVD, CISA KEV and the MSRC page for updates, and recheck status within 48 hours.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  googlesky/CVE-2026-119958

Research sources

• Microsoft Security Response Center: CVE-2026-119958 msrc.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:37.