Description

Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-08T18:20:24.863Z",
  "pubdate": "2026-09-08T18:20:24.863Z",
  "executiveSummary": "This vulnerability is a critical stack-based buffer overflow affecting the Windows Netlogon service. It allows an unauthenticated, remote attacker to execute arbitrary code with elevated privileges on the target system. The flaw exists within the Netlogon Remote Protocol (MS-NRPC) implementation, specifically in how the service handles incoming requests.\nThe vulnerability poses a severe risk to organizational security, as it bypasses standard authentication mechanisms to permit remote code execution (RCE). An attacker can leverage this flaw to gain full control over affected domain controllers or workstations, potentially leading to complete domain compromise. Given that the Netlogon service operates at the system level and is exposed over the network to facilitate secure communication between clients and domain controllers, exploitation does not require prior user credentials or interaction.\nSuccessful exploitation allows an adversary to execute malicious payloads, install persistence mechanisms, or pivot laterally through the network. The ability to achieve code execution in the context of the local system makes this an extremely high-priority vulnerability, necessitating immediate attention to remediation through vendor-supplied security patches or network-level traffic filtering.",
  "technicalDetails": "The vulnerability resides within the Windows Netlogon service (lsass.exe), which implements the Netlogon Remote Protocol (MS-NRPC). The root cause is a failure to properly validate the size of data inputs before copying them into a fixed-length stack-based buffer. When the service parses a specifically crafted Netlogon request, the lack of bounds checking allows the input data to overflow the allocated stack frame.\nThe exploitation flow begins when an attacker sends a malicious MS-NRPC request over the network. The Netlogon service receives this packet and initiates a function call to process the incoming data. Because the input buffer is improperly sized relative to the maximum expected length of the protocol-specific data, the function writes data beyond the defined boundary of the buffer. This overflow overwrites adjacent memory on the stack, including the saved base pointer and the return address.\nBy controlling the return address, an attacker can hijack the control flow of the execution thread. Typically, an attacker will craft the payload to redirect execution to malicious code, often referred to as shellcode, which is included within the same network packet or placed in memory via heap spraying. The payload executes with the privileges of the LSASS process, which inherently runs as NT AUTHORITY\\SYSTEM. This provides the attacker with absolute control over the host environment.\nThe vulnerability is particularly dangerous because it occurs at the network transport layer of the Netlogon protocol. It does not require a valid security context or pre-existing authentication, meaning it is reachable by any entity capable of communicating with the target on the service's designated network port. Post-exploitation impact includes full system compromise, the potential for credential harvesting from the Local Security Authority Subsystem Service, and the capacity to disable security logging or security software.\nBecause the overflow occurs within a core operating system component, the impact extends across the entire domain infrastructure if the affected machine is a Domain Controller. The lack of input sanitization during the initial processing of RPC calls essentially turns the Netlogon service into a vector for remote binary execution."
}