CVE-2026-85324
Awaiting Analysis
Awaiting Analysis - Queue
Memory Exhaustion in Active Directory Federation Services
Vulnerability report for CVE-2026-85324, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-13
Last updated on: 2026-10-13
Assigner: Microsoft Corporation
Description
Description
Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Microsoft | Windows | 10 Version 1607 10.0.14393.0 |
| Microsoft | Windows | 10 Version 1809 10.0.17763.0 |
| Microsoft | Windows | Server 2012 6.2.9200.0 |
| Microsoft | Windows | Server 2012 (Server Core installation) 6.2.9200.0 |
| Microsoft | Windows | Server 2012 R2 6.3.9600.0 |
| Microsoft | Windows | Server 2012 R2 (Server Core installation) 6.3.9600.0 |
| Microsoft | Windows | Server 2016 10.0.14393.0 |
| Microsoft | Windows | Server 2016 (Server Core installation) 10.0.14393.0 |
| Microsoft | Windows | Server 2019 10.0.17763.0 |
| Microsoft | Windows | Server 2019 (Server Core installation) 10.0.17763.0 |
| Microsoft | Windows | Server 2022 10.0.20348.0 |
| Microsoft | Windows | Server 2025 10.0.26100.0 |
| Microsoft | Windows | Server 2025 (Server Core installation) 10.0.26100.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-789 | The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. |
