OnlyPatch
Windows Netlogon

CVE-2026-41089 — Windows Netlogon Remote Code Execution Vulnerability

Critical CVSS 9.8 EPSS 0.79622 🔬 Patch diffed 2026-05 archive

Executive Summary

Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

Overview

9.8
CVSS CRITICAL
Critical
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Remote Code Execution
Weakness CWE-121: Stack-based Buffer Overflow
Released May 12 2026
Last Updated May 12 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.79622 — 0.9957 percentile
NVD CVSS 9.8 CRITICAL — matches MSRC

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Network
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 8.5

EPSS Score

0.79622
probability of exploitation in the next 30 days
0.9957 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

9 affected products
Product KB Article Severity Impact Restart Required
Windows Server 2012 5087470 (Monthly Rollup) Critical Remote Code Execution Yes
Windows Server 2012 (Server Core installation) 5087470 (Monthly Rollup) Critical Remote Code Execution Yes
Windows Server 2012 R2 5087471 (Monthly Rollup) Critical Remote Code Execution Yes
Windows Server 2012 R2 (Server Core installation) 5087471 (Monthly Rollup) Critical Remote Code Execution Yes
Windows Server 2016 5087537 (Security Update) Critical Remote Code Execution Yes
Windows Server 2016 (Server Core installation) 5087537 (Security Update) Critical Remote Code Execution Yes
Windows Server 2019 5087538 (Security Update) Critical Remote Code Execution Yes
Windows Server 2019 (Server Core installation) 5087538 (Security Update) Critical Remote Code Execution Yes
Windows Server 2022 5087545 (Security Update) 5087424 (Security Hotpatch Update) Critical Remote Code Execution 5082142 Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.5139 10.0.20348.5074 Yes None Windows Server 2022 (Server Core installation) 5087545 (Security Update) 5087424 (Security Hotpatch Update) Critical Remote Code Execution 5082142 Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.5139 10.0.20348.5074 Yes None Windows Server 2022, 23H2 Edition (Server Core installation) 5087541 (Security Update) Critical Remote Code Execution Yes

Patches

5 patches
Article Type Restart
5087470 Monthly Rollup Yes
5087471 Monthly Rollup Yes
5087537 Security Update Yes
5087538 Security Update Yes
5087541 Security Update Yes

Patch Diff

ghidriff · netlogon.dll (KB5087539)

Two bugs in the Windows Netlogon DC-Locator response serialization path of netlogon.dll (SYSTEM on a DC), reachable pre-auth over CLDAP (UDP 389), the Netlogon mailslot \MAILSLOT\NET\NETLOGON and RPC. (1) CWE-121 stack buffer overflow in BuildSamLogonResponse/PrimaryQueryHandler: they serialize Unicode strings (domain/DNS/computer name), GUIDs, DNS compression and flags into a fixed 528-byte stack buffer via NetpLogonPutUnicodeString but IGNORED its return value; a near-max input string leaves the write cursor past the buffer or undefined, and subsequent NetpLogonPutBytes/GUID/flag writes corrupt adjacent stack (the DNS NlpUtf8ToCutf8 path already checked its return - the guard was missing only at the NetpLogonPutUnicodeString sites). (2) CWE-908/CWE-200 uninitialized-stack disclosure in NlGetLocalPingResponse: a 528-byte stack buffer Src is used uninitialized, then Size[0] bytes are memcpy'd to a heap buffer for transmission, so inter-field padding leaks prior stack contents (frame pointer, return address, auth-token remnants) to the unauthenticated requester. IN-HOUSE ghidriff of netlogon.dll 10.0.26100.7623 -> .8521 (fix ships May 2026, KB5087539) confirms, gated behind CFR flag Feature_740537659: NetpLogonPutUnicodeString changed void->value-returning (old body kept as NetpLogonPutUnicodeStringOld); BuildSamLogonResponse (3 calls: 0x24/0x82/0x20) and PrimaryQueryHandler (2 calls) now return-check and bail with 1355 on failure; NlGetLocalPingResponse adds memset(Src,0,0x208). Note: our diff shows Feature_740537659, differing from the circulated screenshots' Feature_1008973115 (build/arch difference); the return-checks and memset are identical. Critical (9.8/8.5), AV:N pre-auth, SYSTEM.

Pre-patch version 10.0.26100.7623 Download
Post-patch version 10.0.26100.8521 Download
Function Address Change Note
BuildSamLogonResponse code change code (NetpLogonPutUnicodeString return-checked, CFR-gated) Pre: NetpLogonPutUnicodeStringOld(v10,36)/(a4,130)/(a1+36,32) with return ignored -> cursor may run past the fixed 528-byte stack buffer, later GUID/flag writes overflow. Post (Feature_740537659): three NetpLogonPutUnicodeString calls (0x24/0x82/0x20) in a nested if chain, return-checked; on failure returns 1355 (ERROR_NO_LOGON_SERVERS) with no further writes.
PrimaryQueryHandler code change code (return checks added, CFR-gated) Two NetpLogonPutUnicodeString calls gain return checks; return 0 on serialization failure instead of continuing from a bad write position.
NlGetLocalPingResponse code change code (zero-init response buffer, CFR-gated) Adds memset(Src,0,0x208) right after the NlGlobalMemberWorkstation check, zeroing the 528-byte stack buffer before it is populated and memcpy'd to the transmit buffer -> no uninitialized stack in the response (CWE-908/200).
NetpLogonPutUnicodeString code change code (now returns status) Signature changed void -> value-returning so callers can detect insufficient buffer; the original void body is preserved as NetpLogonPutUnicodeStringOld.
Feature_740537659 gate added (CFR gate) CFR flag gating all three fixes; original paths still ship when disabled.
View full diff report View RCA report

Attack Path

An unauthenticated DC-Locator query overruns Netlogon's fixed 528-byte response stack buffer and leaks uninitialized stack

Attack path for CVE-2026-41089 An unauthenticated DC-Locator query overruns Netlogon's fixed 528-byte response stack buffer and leaks uninitialized stack 01 — ENTRY Unauthenticated attacker sends a DC-Locator/SamLogon query to a DC netlogon.dll (SYSTEM) serializes the response over CLDAP (UDP 389), the Netlogon mailslot, or RPC - all reachable pre-auth. AV:N/PR:N/AC:L. 02 — CONTROLLED INPUT Supplies domain/DNS/computer names near the length limit BuildSamLogonResponse writes each Unicode string into a fixed 528-byte stack buffer via NetpLogonPutUnicodeString, advancing a cursor; a near-max string plus GUID/DNS/flags exceeds 528 bytes. 03 — MISSING CHECK NetpLogonPutUnicodeString's return/failure is ignored (CWE-121) The write can run past the buffer or leave the cursor undefined; subsequent NetpLogonPutBytes/GUID/flag writes then corrupt adjacent stack memory. 04 — PRIMITIVE Stack-based buffer overflow in the SYSTEM Netlogon service -> RCE Controlled overrun of the response stack buffer with attacker-influenced data yields remote code execution as SYSTEM (Critical). 05 — DISCLOSURE Secondary: uninitialized 528-byte Src buffer leaks stack data in the response (CWE-908/200) NlGetLocalPingResponse transmits Size[0] bytes of an uninitialized buffer, leaking frame pointer / return address / token remnants. The May 2026 fix (Feature_740537659) return-checks the string writes and memset()s the buffer.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

Windows Attack Research & Protection (WARP) with Microsoft

On This Page