CVE-2026-100222 in Windows
Summary
by MITRE • 10/13/2026
Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified as a heap-based buffer overflow within the Microsoft Network Policy Server presents a critical security risk that enables remote code execution without authentication. This flaw resides specifically in how NPS processes certain malformed requests, allowing an unauthenticated, network-adjacent attacker to exploit memory corruption issues on the target system. The Network Policy Server is a core component of Windows Server responsible for handling authentication, authorization, and accounting policies, primarily through protocols such as RADIUS. Because this service often listens on open ports accessible from internal networks or even the internet depending on configuration, the attack surface is significant. An attacker can craft specific malicious packets that trigger the overflow condition when NPS attempts to parse them, leading to arbitrary code execution with the privileges of the Network Policy Server process, which typically runs under high-privilege system accounts.
From a technical perspective, heap-based buffer overflows occur when data written to a dynamically allocated memory block exceeds its boundaries, corrupting adjacent memory structures such as metadata used by the allocator or other objects in the heap. In the context of NPS, this likely involves improper validation of input length fields within RADIUS packets or related protocol messages. When the server processes these oversized inputs, it writes data beyond the allocated buffer space on the heap. This corruption can overwrite function pointers, exception handlers, or object headers, allowing an attacker to redirect program execution flow. By carefully crafting the payload and controlling the overwritten memory contents, the attacker can execute arbitrary shellcode, effectively gaining full control over the compromised server. The lack of required authentication makes this vulnerability particularly dangerous as it does not require valid credentials to initiate the exploit chain.
The operational impact of successfully exploiting this vulnerability is severe, resulting in complete compromise of the affected system. Since NPS often manages access for other critical infrastructure components such as wireless networks, VPNs, and switch ports, compromising the server can lead to broader network infiltration. An attacker could use the compromised NPS instance to bypass authentication mechanisms for other services, impersonate legitimate users, or pivot further into the internal network. Additionally, because this is a remote code execution vulnerability with no user interaction required beyond sending packets over the network, it poses a high risk of automated exploitation by worms and botnets targeting vulnerable Windows Server installations globally. The ability to execute code as SYSTEM level privileges means that attackers can install backdoors, modify system configurations, steal sensitive data, or disrupt critical business operations entirely.
Mitigation strategies must focus on immediate patching and network segmentation until updates are applied. Organizations should immediately apply the latest security patches released by Microsoft for their Windows Server versions running Network Policy Server. In environments where patching is not instantly feasible, it is crucial to restrict access to NPS ports (typically UDP 1812 and 1813) using firewalls or network access control lists, allowing connections only from known and trusted authentication clients such as wireless controllers or VPN gateways. Enabling logging for RADIUS traffic can also help in detecting attempts to exploit this vulnerability through anomalous packet sizes or malformed requests. Furthermore, deploying intrusion detection systems with signatures specific to heap overflow patterns targeting NPS can provide an additional layer of defense by blocking malicious payloads before they reach the vulnerable service component.