Quick Start

Three phases: normal ping to confirm the DC is alive, overflow ping with a 130-character username, liveness check. Takes ~10 seconds.

Affected Systems

Every Windows Server version running as a Domain Controller:

Root Cause

NlGetLocalPingResponse allocates a 528-byte stack buffer and hands it to BuildSamLogonResponse. That function calls NetpLogonPutUnicodeString to write server name, domain name, GUIDs, and the attacker-controlled username into the buffer.

The bug: NetpLogonPutUnicodeString receives a maximum length in bytes but treats it as a WCHAR count. Every string written through this path occupies twice the expected space. The "User" field in the CLDAP filter (up to 130 wchars, 260 bytes on the wire) pushes the combined write past the 528-byte boundary.

Usage

Requires Python 3.8+. No third-party packages.

How It Works

1. Phase 1. A normal CLDAP ping with username "testuser" confirms the target responds on UDP 389.
2. Phase 2. The same packet structure, but the username is 130+ characters of "A". This pushes the serialized data past the stack buffer boundary. If LSASS crashes, the recv times out.
3. Phase 3. After a configurable delay, a second normal ping checks whether the DC is still alive. No response = LSASS crash confirmed.

The overflow triggers a denial of service (LSASS crash, DC reboot). RCE through stack corruption is possible in theory. This PoC does not attempt code execution.

Detection

Network. Scan CLDAP traffic for search requests where the "User" filter attribute exceeds 20-30 characters. Normal DC locator pings use service account names (short strings).

Host. Watch for LSASS crashes tied to netlogon.dll (Event ID 1000). Enable Netlogon debug logging:

Mitigation

• Install the May 2026 Microsoft security update
• Restrict UDP 389 inbound to trusted management subnets
• For legacy Server versions out of ESU: 0patch ships micropatches (single instruction fix: mov edx, 0x40 to halve the max username length)

References

• Microsoft Security Update Guide
• NVD - CVE-2026-41089
• 0patch Analysis and Micropatch
• Aretiq AI Reverse Engineering
• RFC 4511 - LDAP
• MS-ADTS - CLDAP DC Locator

Legal. This code exists for authorized security research and education. Test only against systems you own or have written permission to test. Unauthorized access to computer systems violates the CFAA and equivalent laws in most jurisdictions.

MIT License