CVE-2026-42914: Windows Kerberos Out-of-Bounds Read DoS Vulnerability

Technical summary

CVE-2026-42914 is an out-of-bounds read vulnerability (CWE-125) in the Windows Kerberos implementation affecting multiple Windows 10 and Windows 11 releases as well as Windows Server 2012 through 2025. The vulnerability requires low privilege (authenticated) access and high attack complexity, suggesting exploitation depends on specific conditions or sequences that are not trivial to trigger. The out-of-bounds read can be weaponized to crash Kerberos-dependent services or processes, leading to availability impact. No confidentiality or integrity compromise is possible through this vector.

Business impact

Denial of service in Kerberos affects authentication and authorization workflows across the enterprise. Depending on attack persistence and targeting, an attacker could repeatedly knock out directory services, domain authentication, or ticket-granting services, causing user lockouts or preventing legitimate domain operations. The requirement for authentication limits blast radius to insider threats or accounts compromised through phishing, lateral movement, or supply-chain compromise. Organizations relying on Kerberos for SSO or multi-forest environments should assess redundancy and failover mechanisms.

Affected systems

Windows 10 versions 1607, 1809, 21H2, and 22H2 are affected, as are all supported Windows 11 releases (23H2, 24H2, 25H2, 26H1). Windows Server 2012, 2016, 2019, 2022, and 2025 are also in scope. Notably, this spans both consumer and enterprise editions, though the practical impact is highest on domain-joined systems and servers. Air-gapped or workgroup-only systems see no Kerberos traffic, reducing applicability.

Exploitability

Exploitation requires an authenticated attacker with network access and knowledge of how to trigger the specific out-of-bounds condition within Kerberos. The high attack complexity factor suggests this is not a one-click exploit; however, once a valid account is compromised or an insider has access, the barrier to craft or discover working attack payloads is moderate. Public exploit code has not been confirmed to exist (KEV status is false), limiting opportunistic attacks in the near term. Targeted campaigns against high-value infrastructure remain plausible.

Remediation

Apply security updates from Microsoft as they become available through Windows Update or WSUS. Organizations should prioritize patching domain controllers and critical authentication infrastructure first. Interim mitigations include network segmentation to limit which systems can reach Kerberos services, credential hygiene (minimize privileged account exposure), and monitoring for anomalous Kerberos ticket requests or service crashes. Organizations on extended support lifecycles (e.g., Windows Server 2012) should verify patch availability with Microsoft before assuming updates are forthcoming.

Patch guidance

Check Microsoft's security updates released concurrently with or after the June 2026 advisory date. Patches should be validated in a staging environment, particularly on domain controllers where Kerberos availability is critical. Coordinate patching with change windows to minimize authentication disruption. For Windows 10, ensure you are on a supported version (1607 is nearing end-of-service; prioritize 22H2). For Windows 11, all listed versions should receive updates through regular monthly rollups. Verify against Microsoft's official advisory to confirm patch KB numbers for your specific version.

Detection guidance

Monitor for unexpected crashes or restarts of processes linked to Kerberos (e.g., lsass.exe on domain controllers, krbtgt services). Collect Kerberos audit events (event IDs 4624, 4768, 4769) and look for spikes in failed authentication or ticket requests from a single source. Deploy host-based memory access monitoring if available; out-of-bounds reads may trigger access violation logs in Event Viewer or EDR telemetry. Correlate service availability incidents with authentication audit logs to identify whether Kerberos DoS was the root cause.

Why prioritize this

Although the CVSS score is moderate (5.3), the vulnerability affects foundational authentication infrastructure spanning Windows client and server editions. Any successful denial of service targeting Kerberos can cascade across the domain, impacting all user login attempts and service-to-service authentication. The need for authentication lowers immediate risk from external attackers, but the broad affected product list and critical nature of Kerberos warrant prioritization above non-authentication DoS vulnerabilities. Organizations should plan patching within their next security update cycle rather than deferring.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium) reflects high availability impact (A:H) constrained by network accessibility requiring authentication (AV:N, PR:L) and high attack complexity (AC:H). There is no confidentiality or integrity risk. The score appropriately flags this as a threat to service continuity rather than data confidentiality. In practical business terms, the criticality of Kerberos means the risk should not be underestimated; a CVSS 5.3 targeting authentication is more severe than a CVSS 5.3 targeting a non-critical application.

Frequently asked questions