Description

Use after free in Active Directory Certificate Services (AD CS) allows an authorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T17:18:35.797Z",
  "pubdate": "2026-08-11T17:18:35.797Z",
  "executiveSummary": "This vulnerability is classified as a Use After Free (UAF) memory corruption flaw affecting Active Directory Certificate Services (AD CS). The vulnerability allows an authorized remote attacker to achieve arbitrary code execution over the network against targeted systems running the affected component. The security implications are severe, as successful exploitation compromises the confidentiality, integrity, and availability of the certificate authority infrastructure.\nThe attacker capabilities required to exploit this vulnerability include network access and valid authorization within the domain environment. Exploitation hinges on manipulating object lifecycles within memory management routines of the vulnerable service. When the application accesses a memory address after it has been deallocated, an attacker who has successfully manipulated the heap layout can achieve arbitrary code execution within the context of the running service account, potentially leading to full domain compromise given the critical nature of AD CS servers.",
  "technicalDetails": "The vulnerability resides in the memory management handling of Active Directory Certificate Services (AD CS). Specifically, the flaw is a Use After Free (UAF) condition where a pointer to a dynamically allocated memory object is not properly nullified or managed after the underlying memory is freed. This creates a dangling pointer condition within the vulnerable component.\nExploitation of this vulnerability requires the attacker to have network connectivity to the AD CS endpoint and appropriate authorization. The attack flow begins with the attacker interacting with the service using specific protocol requests designed to allocate and subsequently deallocate the targeted memory object. Through precise heap grooming and manipulation techniques, the attacker forces the application to reallocate the freed memory location with attacker-controlled data, such as a crafted payload or fake object structure.\nWhen the service subsequently attempts to access the dangling pointer, it references the attacker-controlled data as if it were the original legitimate object. This anomalous dereference leads to control flow hijacking. Because AD CS typically operates with high privileges within the Windows domain architecture, executing arbitrary code via this memory corruption vector allows the attacker to execute instructions in the security context of the service, facilitating extensive post-exploitation activities and lateral movement across the network."
}