Description

Numeric truncation error in Microsoft Digest Authentication allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:19.303Z",
  "pubdate": "2026-08-11T17:18:19.303Z",
  "executiveSummary": "A numeric truncation vulnerability exists within Microsoft Digest Authentication, allowing an authorized local attacker to successfully elevate privileges on vulnerable systems.\nThe vulnerability type is classified as a numeric truncation error, which occurs when a larger data type is converted into a smaller data type without adequate boundary checks, resulting in memory corruption or miscalculated buffer allocations.\nSuccessful exploitation of this flaw grants the attacker elevated privileges, potentially leading to a complete compromise of the local operating system.\nThe affected component is the Microsoft Digest Authentication protocol implementation within the operating system.\nRisk implications are high because an authenticated local adversary can leverage this vulnerability to bypass standard security controls and execute arbitrary code or commands with higher privilege levels, such as SYSTEM.\nAttacker capabilities require local execution access on the target machine, meaning the adversary must already possess valid credentials or initial code execution capabilities within the local environment.\nExploitation requirements include local authentication and the ability to interact with the vulnerable Microsoft Digest Authentication subsystem to trigger the specific numeric truncation condition.",
  "technicalDetails": "The root cause of the vulnerability stems from a numeric truncation error during the processing of specific parameters within the Microsoft Digest Authentication mechanism.\nWhen handling input data or length specifiers, the underlying code performs an unsafe downcasting operation, converting a wide integer type into a narrower integer type (e.g., from a 64-bit or 32-bit integer to a 16-bit or 8-bit integer) without validating whether the numeric value exceeds the destination type maximum threshold.\nThis truncation leads to an integer wrap-around or a miscalculation of memory buffer sizes allocated for subsequent data parsing.\nThe vulnerable component is identified as the Microsoft Digest Authentication handler, which processes authentication challenges and responses.\nThe attack flow proceeds as follows: First, the authorized local attacker crafts a specialized payload or input sequence containing maliciously sized parameters designed to trigger the numeric truncation upon being processed by the Microsoft Digest Authentication service.\nSecond, the attacker interacts with the local authentication APIs or services that invoke the vulnerable digest parsing routines.\nThird, when the parsing routine processes the oversized value, the numeric truncation occurs, resulting in a heap-based or stack-based buffer allocation that is significantly smaller than required to hold the incoming data.\nFourth, subsequent copy operations write data past the boundaries of the undersized buffer, causing memory corruption.\nFifth, by carefully controlling the memory layout and the overflow contents, the attacker can overwrite adjacent critical data structures or function pointers.\nFinally, the attacker achieves arbitrary code execution within the context of the vulnerable service, leading to local privilege escalation to higher privilege levels.\nThe attack vector is local, requiring the attacker to have local interactive access or the ability to execute code locally, combined with valid authentication privileges required to interface with the Digest Authentication mechanism.\nNetwork exposure is not strictly required for initial exploitation since the attack vector is local, although remote variants of authentication requests could theoretically interact with the vulnerable codepath if exposed via specific network services utilizing Microsoft Digest."
}