CVE-2026-41089: Windows Netlogon RCE — One-Packet CLDAP Attack, LSASS Crash, and Active Directory Risk

Vulnerability at a Glance

What Actually Happens

Netlogon is the authentication backbone of every Active Directory environment. Before a client logs in, finds a domain controller, or validates a Kerberos ticket, it sends a DC locator ping — a lightweight CLDAP (Connectionless LDAP) query over UDP port 389. This happens thousands of times a day across any enterprise network.

CVE-2026-41089 lives in the CLDAP DC locator response handler inside netlogon.dll. The handler allocates a 528-byte stack buffer to process the Username attribute from an incoming ping — without validating length before writing. An attacker sends a crafted packet with a 130-character username field. The buffer overflows, the GS stack cookie trips, and Windows terminates the process with STATUS_STACK_BUFFER_OVERRUN (0xc0000409).

The process being terminated is LSASS — the Local Security Authority Subsystem. LSASS holds every active credential in the domain. When it crashes, the domain controller reboots. Authentication across the entire domain goes offline for approximately 60 seconds.

Attacker ──► UDP/389 ──► crafted CLDAP ping (Username: 130 chars)
  └─► netlogon.dll 528-byte stack buffer overflow
        └─► GS cookie violation → STATUS_STACK_BUFFER_OVERRUN (0xc0000409)
              └─► LSASS crash → DC reboot → ~60s domain-wide auth blackout

The RCE Question

Microsoft formally rates this as a Remote Code Execution vulnerability with a CVSS of 9.8. The realistic picture is more nuanced — two distinct exploitation outcomes exist at very different reliability levels.

The DNS Name Length Prerequisite

The overflow becomes reliably triggerable only when the target domain's fully qualified DNS name exceeds approximately 50 characters. Short domain names may not produce a large enough response payload to consistently overflow the buffer.

This is not a meaningful barrier in enterprise environments. Large organizations routinely operate domains like corp.enterprise-division.companyname.internal or nested regional structures. MSPs managing multiple customer forests are very likely operating domains above this threshold. The prerequisite narrows the exploitable population — it does not protect most affected organizations.

Affected Versions

Why Domain Controllers Are the Worst Possible Target

A domain controller is not just another server. It is the identity control plane — the trust anchor for every device, user, and application in the organization. The blast radius of a DC compromise scales with everything connected to it.

At the DoS Level (reliable today)

• Repeatable kill switch for domain authentication — zero credentials required
• Disrupts login, application access, and any Kerberos-dependent service on demand
• Provides cover for simultaneous attacks that exploit the disruption window

At Full RCE Level (theoretical)

High-Value Targets

Example Attack Sequence

# Stage 1 — Recon
Scan for UDP/389 (CLDAP) on Internet-exposed or DMZ-reachable IP ranges
Send benign DC locator ping → identify active DCs, capture DNS domain name

# Stage 2 — Prerequisite Check
Does the DNS name exceed ~50 characters?
If yes → proceed. If no → move to next target.

# Stage 3 — Exploit (DoS — reliable)
Send single crafted CLDAP ping with 130-char Username attribute
LSASS crashes → DC reboots → ~60s domain-wide auth blackout
Repeat as needed for sustained disruption

# Stage 4 — Escalation (if full RCE achieved)
Spawn reverse shell from LSASS context (SYSTEM privileges)
DCSync → extract krbtgt hash
Forge Golden Ticket → persistent, undetected forest-wide access
Deploy ransomware/backdoor via GPO to all domain-joined machines

Misconfigurations That Increase Exposure

• No network segmentation — any internal host can reach DC on UDP 389
• DC exposed to the Internet or DMZ with inbound UDP 389 permitted
• Rolling patch deployment — one unpatched DC in the forest is sufficient for exploitation
• End-of-life Windows Server (2008 R2 without micropatch, 2012 without ESU)
• No LSASS crash alerting — unexpected DC reboots treated as infrastructure issues, not security events
• DNS domain names ≥ 50 characters with no compensating controls

Relationship to Zerologon (CVE-2020-1472)

Same target, different root cause, different exploitation mechanics. Both unauthenticated, both attacking the domain's core trust anchor.

Part 2 covers the public PoC, active exploit analysis, and how the vulnerability is being weaponized in the wild.