Stack-based buffer overflow in Windows Netlogon

CVE-2026-41089 is a stack-based buffer overflow in Windows Netlogon tied to how a domain controller handles CLDAP DC locator ping responses. Microsoft and NVD describe it as unauthenticated network RCE, while Microsoft’s May 12, 2026 research post and Aretiq’s May 13, 2026 write-up place the bug in netlogon.dll during CLDAP User= filter processing on UDP/389. Affected platforms span Windows Server 2012, 2012 R2, 2016 before 10.0.14393.9140, 2019 before 10.0.17763.8755, 2022 before 10.0.20348.5074, 2022 23H2 before 10.0.25398.2330, and 2025 before 10.0.26100.32772.

Vendor severity overstates the practical exposure. The big friction is that this lands on *domain controllers* and, per 0patch and Aretiq, exploitation depends on local-network reach to UDP/389 plus a sufficiently long DNS domain/host naming combination; Aretiq also argues present research more cleanly demonstrates LSASS crash/reboot than reliable attacker-controlled RCE because overwritten bytes are largely server-derived and modern stack protections matter. That still leaves meaningful enterprise risk because one reachable DC is a crown-jewel target, but it is not the same thing as an internet-scale wormable flaw.

Why this verdict

• Internal-network requirement cuts the score down: 0patch explicitly frames the attacker as being in the local network, which implies post-initial-access in many enterprises rather than internet-scale exploitability.
• Exposed population is narrow: this matters on domain controllers answering CLDAP, not the average Windows endpoint or random member server, so the reachable estate is much smaller than the raw CVSS suggests.
• Target-specific naming friction is real: Aretiq says exploitability depends on sufficiently long DNS domain/host naming, which means some otherwise affected DCs do not cleanly satisfy the trigger condition.
• Public impact evidence is stronger for crash/reboot than clean RCE: Aretiq highlights stack-cookie and overwrite-content constraints that make reliable code execution harder than a vendor 9.8 implies.
• But the crown-jewel blast radius keeps it elevated: if a reachable DC can be crashed or eventually popped pre-auth, that is still a bad day for authentication, lateral movement, and enterprise resilience.

Why not higher?

This is not a broad internet-facing Windows RCE in the way defenders hear '9.8 pre-auth' and think worm pressure. The chain narrows quickly: DC-only relevance, CLDAP reachability, and a naming-dependent trigger all compound downward, and the public research reviewed does not yet establish turnkey reliable RCE in the field.

Why not lower?

A no-auth packet path into a domain controller is never routine backlog material. Even if today’s most credible public outcome is forced LSASS crash and reboot, that still threatens authentication availability on crown-jewel systems and offers a high-value target for exploit maturation.

1. Restrict CLDAP to domain controllers — Use host firewalls, ACLs, and segmentation to allow UDP/389 to DCs only from approved management networks, member servers, and client segments that genuinely need directory discovery. For a HIGH verdict, deploy this within 30 days to reduce reachable population before patch completion.
2. Audit DC network exposure — Enumerate every DC and verify which networks can reach UDP/389, including VPN pools, server VLANs, VDI ranges, and partner links. This closes the biggest real-world amplifier here — unnecessary east-west reachability — and should be completed within 30 days.
3. Monitor LSASS and Netlogon instability — Alert on LSASS crashes, Netlogon service faults, unexpected DC reboots, and bursts of anomalous UDP/389 traffic. This will not prevent exploitation, but it gives you immediate signal if someone is testing or weaponizing the path while you work through remediation within the 180-day patch window.
4. Prioritize flat-network and Tier-0 segments — Patch DCs first in enclaves where workstations, jump hosts, or third-party connections can route to Tier 0. That is where the internal-network prerequisite is easiest for an attacker to satisfy; use compensating restrictions within 30 days and finish vendor remediation within 180 days.

Run this on each Windows Server target host, ideally the domain controllers themselves, from an elevated PowerShell session. Example: powershell.exe -ExecutionPolicy Bypass -File .\check-CVE-2026-41089.ps1; it needs local admin rights to read OS build and installed hotfix data.

# check-CVE-2026-41089.ps1

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Write-Result {
    param(
        [string]$State,
        [string]$Message,
        [int]$Code
    )
    Write-Output "$State - $Message"
    exit $Code
}

function Get-OsBuildString {
    $cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    $build = [int]$cv.CurrentBuildNumber
    $ubr = [int]$cv.UBR
    return [PSCustomObject]@{
        ProductName   = $cv.ProductName
        DisplayVersion = $cv.DisplayVersion
        ReleaseId     = $cv.ReleaseId
        Build         = $build
        UBR           = $ubr
        FullBuild     = "$build.$ubr"
    }
}

function Test-IsDomainController {
    $cs = Get-CimInstance Win32_ComputerSystem
    return ($cs.DomainRole -eq 4 -or $cs.DomainRole -eq 5)
}

function Test-HotFixInstalled {
    param([string]$Kb)
    try {
        $null = Get-HotFix -Id $Kb -ErrorAction Stop
        return $true
    } catch {
        return $false
    }
}

try {
    $os = Get-OsBuildString
    $isDC = Test-IsDomainController

    if (-not $isDC) {
        Write-Result -State 'UNKNOWN' -Message "Host is not a domain controller (build $($os.FullBuild)); this check is intended for DC exposure." -Code 2
    }

    $product = $os.ProductName
    $build = $os.Build
    $ubr = $os.UBR

    switch ($build) {
        14393 {
            if ($ubr -ge 9140) {
                Write-Result 'PATCHED' "Windows Server 2016 build $($os.FullBuild) meets fixed level 14393.9140." 0
            } else {
                Write-Result 'VULNERABLE' "Windows Server 2016 build $($os.FullBuild) is below fixed level 14393.9140." 1
            }
        }
        17763 {
            if ($ubr -ge 8755) {
                Write-Result 'PATCHED' "Windows Server 2019 build $($os.FullBuild) meets fixed level 17763.8755." 0
            } else {
                Write-Result 'VULNERABLE' "Windows Server 2019 build $($os.FullBuild) is below fixed level 17763.8755." 1
            }
        }
        20348 {
            if ($ubr -ge 5074) {
                Write-Result 'PATCHED' "Windows Server 2022 build $($os.FullBuild) meets fixed level 20348.5074." 0
            } else {
                Write-Result 'VULNERABLE' "Windows Server 2022 build $($os.FullBuild) is below fixed level 20348.5074." 1
            }
        }
        25398 {
            if ($ubr -ge 2330) {
                Write-Result 'PATCHED' "Windows Server 2022 23H2 build $($os.FullBuild) meets fixed level 25398.2330." 0
            } else {
                Write-Result 'VULNERABLE' "Windows Server 2022 23H2 build $($os.FullBuild) is below fixed level 25398.2330." 1
            }
        }
        26100 {
            if ($ubr -ge 32772) {
                Write-Result 'PATCHED' "Windows Server 2025 build $($os.FullBuild) meets fixed level 26100.32772." 0
            } else {
                Write-Result 'VULNERABLE' "Windows Server 2025 build $($os.FullBuild) is below fixed level 26100.32772." 1
            }
        }
        9200 {
            if ($product -match '2012 R2') {
                if (Test-HotFixInstalled 'KB5087471') {
                    Write-Result 'PATCHED' 'Windows Server 2012 R2 has KB5087471 installed.' 0
                } else {
                    Write-Result 'VULNERABLE' 'Windows Server 2012 R2 is missing KB5087471.' 1
                }
            } else {
                if (Test-HotFixInstalled 'KB5087470') {
                    Write-Result 'PATCHED' 'Windows Server 2012 has KB5087470 installed.' 0
                } else {
                    Write-Result 'VULNERABLE' 'Windows Server 2012 is missing KB5087470.' 1
                }
            }
        }
        default {
            Write-Result 'UNKNOWN' "Unsupported or unrecognized server build $($os.FullBuild) ($product). Validate manually against vendor guidance." 2
        }
    }
} catch {
    Write-Result 'UNKNOWN' $_.Exception.Message 2
}

Sources

1. NVD entry for CVE-2026-41089
2. Microsoft Security Blog: MDASH findings including CVE-2026-41089
3. Aretiq AI technical analysis of CVE-2026-41089
4. 0patch blog on micropatches for CVE-2026-41089
5. Rapid7 vulnerability database entry with KB mappings
6. CISA Known Exploited Vulnerabilities Catalog
7. GitHub Advisory Database entry for CVE-2026-41089