CVE-2026-54115

Analyzed Analyzed - Analysis Complete

Integer Overflow in Windows Active Directory Leads to Privilege Escalation

Publication date: 2026-07-14

Last updated on: 2026-07-21

Assigner: Microsoft Corporation

Description

Integer overflow or wraparound in Windows Active Directory allows an authorized attacker to elevate privileges locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-21

Generated

2026-08-03

AI Q&A

2026-07-14

EPSS Evaluated

2026-08-02

NVD

CVE-2026-54115

EUVD

EUVD-2026-44133

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_server_2012	r2
microsoft	windows_server_2012	*
microsoft	windows_10_1607	to 10.0.14393.9339 (exc)
microsoft	windows_10_1607	to 10.0.14393.9339 (exc)
microsoft	windows_10_1809	to 10.0.17763.9020 (exc)
microsoft	windows_10_1809	to 10.0.17763.9020 (exc)
microsoft	windows_server_2016	to 10.0.14393.9339 (exc)
microsoft	windows_server_2019	to 10.0.17763.9020 (exc)
microsoft	windows_server_2022	to 10.0.20348.5386 (exc)
microsoft	windows_server_2025	to 10.0.26100.33158 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7548 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7548 (exc)
microsoft	windows_11_24h2	to 10.0.26100.8875 (exc)
microsoft	windows_11_26h1	to 10.0.28000.2525 (exc)
microsoft	windows_11_25h2	to 10.0.26200.8875 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

CVE-2026-54115 is an integer overflow or wraparound vulnerability in Windows Active Directory. This flaw allows an authorized attacker with local access to exploit the vulnerability to elevate their privileges on the system.

An integer overflow occurs when a calculation exceeds the maximum limit of the integer data type, causing it to wrap around to a smaller or negative value. In this case, the vulnerability could be leveraged by an attacker to gain higher-level permissions than they are authorized for.

Detection Guidance

Detection requires checking for signs of privilege escalation attempts in Windows Active Directory. Monitor for unusual account activity, failed login attempts, or unexpected privilege changes. Use Event Viewer to review Security logs for Event ID 4624 (successful logons) and 4672 (special privileges assigned). Check for processes running with elevated privileges without justification.

Impact Analysis

If you are using Windows Active Directory, this vulnerability could have several impacts:

An attacker with local access and low privileges could exploit this flaw to gain elevated privileges, such as administrative rights.
Once privileges are elevated, the attacker could perform unauthorized actions, such as accessing sensitive data, installing malware, or disrupting system operations.
The vulnerability could lead to a full compromise of the affected system or domain, depending on the attacker's objectives.

Compliance Impact

This vulnerability could impact compliance with several standards and regulations in the following ways:

GDPR: If the vulnerability leads to unauthorized access to personal data, it could result in a data breach. Organizations must report such breaches within 72 hours under GDPR, and failure to secure systems could lead to fines or penalties.
HIPAA: For organizations handling protected health information (PHI), exploitation of this vulnerability could lead to unauthorized access to sensitive patient data. This would violate HIPAA's Security Rule, which requires safeguards to protect PHI.
Other standards like ISO 27001 or NIST frameworks require organizations to maintain secure systems and address vulnerabilities promptly. Failure to patch or mitigate this vulnerability could result in non-compliance.

The specific impact depends on the nature of the data and systems affected, but the risk of non-compliance increases if the vulnerability is exploited.

Mitigation Strategies

Apply the security update provided by Microsoft for CVE-2026-54115. The update addresses the integer overflow or wraparound issue in Windows Active Directory that could allow privilege elevation.

To obtain the update, visit the Microsoft Update Guide linked in the resources and follow the instructions for patching affected systems.

Hi! I’m here to help you understand CVE-2026-54115. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70