CVE-2026-50355

Analyzed Analyzed - Analysis Complete

Stack-based Buffer Overflow in Active Directory Federation Services

Publication date: 2026-07-14

Last updated on: 2026-07-24

Assigner: Microsoft Corporation

Description

Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-24

Generated

2026-08-03

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-50355

EUVD

EUVD-2026-43906

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_server_2012	r2
microsoft	windows_server_2012	*
microsoft	windows_10_1607	to 10.0.14393.9339 (exc)
microsoft	windows_10_1607	to 10.0.14393.9339 (exc)
microsoft	windows_10_1809	to 10.0.17763.9020 (exc)
microsoft	windows_10_1809	to 10.0.17763.9020 (exc)
microsoft	windows_server_2016	to 10.0.14393.9339 (exc)
microsoft	windows_server_2019	to 10.0.17763.9020 (exc)
microsoft	windows_server_2022	to 10.0.20348.5386 (exc)
microsoft	windows_server_2025	to 10.0.26100.33158 (exc)
microsoft	.net_framework	4.8.1
microsoft	.net_framework	4.8
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This is a stack-based buffer overflow vulnerability in Active Directory Federation Services. It allows an unauthorized attacker to cause a denial of service over a network by exploiting a flaw that overwrites memory on the stack.

Detection Guidance

Detection requires monitoring for unusual network traffic or service crashes related to Active Directory Federation Services. Check for event logs indicating buffer overflow attempts or service failures in AD FS components.

Impact Analysis

An attacker could exploit this to crash services or systems running Active Directory Federation Services, leading to service unavailability and potential disruption of authentication and identity management functions.

Compliance Impact

This vulnerability primarily causes a denial of service, which may disrupt services but does not directly lead to unauthorized data access or disclosure. Compliance impact depends on the affected system's role and data processed. For GDPR, availability issues could affect data subject rights. For HIPAA, service disruption may impact access to protected health information.

Mitigation Strategies

Apply the latest security updates from Microsoft for Active Directory Federation Services as soon as possible to patch the stack-based buffer overflow vulnerability.

Hi! I’m here to help you understand CVE-2026-50355. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70