@christopherkunz
Ah, so you've confirmed that it works?
With AI and clout seeking these days, we've long passed the "PoC exists on Github" thing having any meaning whatsoever. 😂
Personally, I couldn't get that one to do anything.
1. Overview A stack-based buffer overflow vulnerability exists in the Windows Netlogon service’s DC locator ping response handler. When a domain controller processes a CLDAP search request, it serializes response data including attacker-supplied and server-side strings into a fixed-size stack buffer without adequate bounds checking. An unauthenticated remote attacker can send a single crafted CLDAP packet to a domain controller’s UDP port 389, causing the Netlogon service to crash the LSASS process and force the domain controller to reboot. The exploitability depends on the target domain controller’s DNS naming configuration — domain controllers with longer DNS domain names and hostnames are vulnerable. Microsoft addressed this vulnerability in the May 2026 security update.
I miss the days when things like this were written by humans, using logic and facts. As opposed to statistically plausible slop.
CVE-2026-41089 checker: unauthenticated, non-destructive detection for the Netlogon CLDAP stack buffer overflow (CVSS 9.8). Reports whether a domain controller's domain is long enough to crash,...
@christopherkunz
I also tested another PoC and it was even more fake. i.e. it didn't even create a CLDAP structure that made sense.
I get that PoC||GTFO is a thing, but we've clearly entered a phase where it needs to be Verified PoC||GTFO. 🤦♂️
Walkthrough of how to bindiff a Patch Tuesday Windows CVE end-to-end — from MSU acquisition to function-level bug identification. CVE-2026-41089 (Netlogon pre-auth RCE) as the running example. Methodology, tooling, and the honest limits of trigger development without weeks of exploit engineering.
Dr. Christopher Kunz
Will Dormann
tehfishman
cR0w
Kevin Beaumont
Buttered Jorts
Marius (windsheep)