CVE-2026-85806 in Windows
Summary
by MITRE • 10/14/2026
Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves a critical integer underflow within the Network Policy Server, commonly known as NPS, which is a core component of Microsoft Windows responsible for remote authentication and authorization services such as RADIUS. This specific flaw arises from improper handling of numerical values during the processing of network policy requests, leading to an arithmetic operation that results in a negative value where a positive or zero value was expected. In systems programming, integer underflows can cause buffer sizes or loop counters to be calculated incorrectly, often resulting in massive allocation errors or out-of-bounds memory access when the system interprets the wrapped-around large unsigned integer as a valid size parameter. This technical flaw allows an unauthorized attacker who has network connectivity to the vulnerable NPS service to craft maliciously formatted packets that exploit this arithmetic error during the authentication handshake process.
The operational impact of this vulnerability is severe, as it enables remote code execution without requiring any user interaction or prior authentication credentials. An attacker positioned on a local area network can send specially crafted RADIUS requests to the NPS server, triggering the integer underflow and subsequently gaining the ability to execute arbitrary code with the privileges of the Network Policy Server process. This typically results in full system compromise, allowing the attacker to install malware, steal sensitive data, or use the compromised server as a pivot point for further attacks within the enterprise network infrastructure. The ease of exploitation over the network makes this a high-severity threat that can be leveraged by automated worm-like propagation mechanisms if left unpatched across multiple systems in an organization.
From a classification perspective, this vulnerability aligns with CWE-190, which defines integer overflow or wraparound errors, specifically manifesting as an underflow condition during data processing. The attack vector is categorized under ATT&CK technique T1210, Exploitation of Remote Services, indicating that the attacker leverages a network-accessible service to achieve initial access and code execution. This classification highlights the importance of securing remote management interfaces and authentication services against malformed input attacks.
Mitigation strategies must prioritize immediate patching through official Microsoft security updates designed to correct the integer handling logic within the NPS component. In environments where patching is not immediately feasible, network segmentation should be implemented to restrict access to RADIUS ports from untrusted networks. Additionally, deploying intrusion detection systems with signatures capable of identifying malformed RADIUS packets can provide an additional layer of defense by blocking exploit attempts before they reach the vulnerable service. Regular auditing of NPS configurations and ensuring that only authorized administrators have access to modify network policies are also essential steps in reducing the attack surface associated with this critical infrastructure component.