CVE-2026-49164 is a high severity heap based buffer overflow (CVSS 8.1) in Active Directory Domain Services that lets an unauthorized attacker execute code over a network. It is listed for Windows 10, Windows 11 and Windows Server. Install the Microsoft update for your build, starting with domain controllers.
What's affected
Active Directory Domain Services on Windows, with the record listing Windows 10 versions 1607 to 22H2, Windows 11 24H2, 25H2 and 26H1, and Windows Server 2012, among others. The list in the record is cut short, so read the MSRC entry for the full set and the update for each build. The MSRC page is script driven and did not load text for our review.
The vector is network based with high attack complexity, no privileges and no user interaction.
How to check if you're exposed
Windows Update, Microsoft Update Catalog or your patch management tool will show the update for your build. Run winver or Get-ComputerInfo to read the OS version, then find the entry for your build in the MSRC page.
Focus on domain controllers first. Inventory them, check their patch level, and confirm replication partners are patched too.
What to do now
- Open the MSRC entry for CVE-2026-49164 and find the update for each of your Windows builds.
- Patch domain controllers first, in a staged order, with a tested rollback.
- Limit which systems can reach domain controller ports, using firewalls and network segmentation.
- Monitor domain controllers for crashes, unexpected restarts and unusual directory service errors.
Why it matters
The class is CWE-122, heap based buffer overflow. A memory write goes past the end of an allocated buffer, which can corrupt data next to it and, in some cases, be turned into code execution. In a directory service that holds every account in the domain, a compromise carries high stakes.
The high attack complexity lowers the odds of reliable exploitation, but it does not make a domain controller safe to leave unpatched. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-49164 is a handy place to follow later updates.
Quick check
Why patch domain controllers first?
They hold the directory. A flaw that runs code on one is more costly than on a normal workstation.
Sources
Last reviewed: 19 October 2026.
