CVE-2026-84001 in Windows
Summary
by MITRE • 09/09/2026
Out-of-bounds read in Windows Key Distribution Center allows an unauthorized attacker to deny service over a network.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an out-of-bounds read within the Microsoft Windows Key Distribution Center (KDC) represents a critical security flaw that impacts the integrity and availability of Kerberos authentication services. The KDC is a core component of the Active Directory infrastructure, responsible for issuing Ticket Granting Tickets (TGTs) and service tickets to authenticated users and computers. When an attacker interacts with this service through network requests, they can trigger a memory access violation due to improper bounds checking during the processing of specific Kerberos protocol messages. This flaw allows an unauthorized actor to read data from outside the intended buffer boundaries, which typically results in the corruption of internal state or the triggering of a system exception that forces the KDC process to terminate unexpectedly.
From a technical perspective, this issue is classified under CWE-125, Out-of-bounds Read, indicating that the software fails to validate whether an index or pointer remains within the allocated memory space before performing a read operation. In the context of Kerberos, malformed packets containing crafted fields can cause the KDC service to access invalid memory locations. While out-of-bounds reads are often associated with information disclosure vulnerabilities where sensitive data might be leaked to the attacker, in this specific instance involving the Windows KDC, the primary consequence observed is a denial of service condition. The instability caused by accessing unmapped or protected memory regions leads to crashes within the key distribution center process, effectively halting authentication requests for all clients relying on that domain controller.
The operational impact of this vulnerability is severe due to its potential for remote exploitation without requiring prior authentication in certain configurations or scenarios where pre-authentication can be bypassed or manipulated. An attacker positioned on the network segment connected to the affected Domain Controller can send specially crafted packets designed to exploit the memory handling error. Upon successful execution, the KDC service crashes, resulting in a denial of service for all users and services attempting to authenticate through that specific controller. This disruption prevents legitimate access to network resources, email systems, file shares, and other Active Directory-dependent applications, thereby causing significant operational downtime and potential data loss if critical processes are interrupted during transactions.
This vulnerability aligns with MITRE ATT&CK technique T1498, Network Denial of Service, specifically under the sub-technique related to resource exhaustion or service disruption via protocol exploitation. It also relates to T1078, Valid Accounts, as attackers may leverage compromised credentials to send malicious requests if pre-authentication is enforced but can be bypassed in legacy configurations. The attack vector is classified as Network (T1059), allowing remote execution over TCP/IP connections typically on port 88 where Kerberos traffic flows. Defense-in-depth strategies are essential, including ensuring that all Windows systems and domain controllers are updated with the latest security patches provided by Microsoft to address this specific memory handling flaw in the KDC component.
Mitigation requires immediate patching of affected Windows Server versions running the Active Directory Domain Services role. Administrators should verify that the cumulative updates addressing CVE details for out-of-bounds reads in Kerberos components are installed on all domain controllers. Additionally, network segmentation and firewall rules can be employed to restrict access to port 88 from untrusted networks or specific IP ranges known to host potential attackers. Monitoring tools such as Windows Event Logs should be configured to alert on KDC service crashes or abnormal packet sizes that might indicate exploitation attempts. Regular vulnerability assessments and penetration testing focused on authentication services help identify similar misconfigurations or unpatched systems before they can be leveraged by malicious actors for denial of service attacks against critical identity infrastructure.