LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089

calendar Jun 11, 2026 · attack.impact attack.t1499 cve.2026-41089 detection.emerging-threats  ·
Share on: linkedin copy

Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409). This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability, which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service, leading to a stack-based buffer overflow and subsequent crash of the LSASS process.

Sigma rule (View on GitHub)

 1title: LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089
 2id: f8a66a02-4a16-46e5-b7fd-a42c8a93d137
 3status: experimental
 4description: |
 5    Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409).
 6    This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability,
 7    which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service,
 8    leading to a stack-based buffer overflow and subsequent crash of the LSASS process.    
 9references:
10    - https://aretiq.ai/research/vul260513-cve-2026-41089-microsoft-windows-netlogon-buildsamlogonresponse-stack-based-buffer-overflow-rce/
11    - https://learn.microsoft.com/en-us/shows/inside/c0000409
12    - https://github.com/p3Nt3st3r-sTAr/CVE-2026-41089
13    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089
14author: Swachchhanda Shrawan Poudel (Nextron Systems)
15date: 2026-06-02
16tags:
17    - attack.impact
18    - attack.t1499
19    - cve.2026-41089
20    - detection.emerging-threats
21logsource:
22    product: windows
23    service: application
24detection:
25    selection:
26        Provider_Name: 'Application Error'
27        EventID: 1000
28        AppName: 'lsass.exe'
29        ModuleName: 'netlogon.dll'
30        ExceptionCode: 'c0000409' # STATUS_STACK_BUFFER_OVERRUN
31    condition: selection
32falsepositives:
33    - Unknown
34level: high

References

  • CVE-2026-41089 — Microsoft Windows Netlogon BuildSamLogonResponse Stack-based Buffer Overflow RCE

    1. Overview A stack-based buffer overflow vulnerability exists in the Windows Netlogon service’s DC locator ping response handler. When a domain controller processes a CLDAP search request, it serializes response data including attacker-supplied and server-side strings into a fixed-size stack buffer without adequate bounds checking. An unauthenticated remote attacker can send a single crafted CLDAP packet to a domain controller’s UDP port 389, causing the Netlogon service to crash the LSASS process and force the domain controller to reboot. The exploitability depends on the target domain controller’s DNS naming configuration — domain controllers with longer DNS domain names and hostnames are vulnerable. Microsoft addressed this vulnerability in the May 2026 security update.


    Read More

  • Fail Fast Exception C0000409

    A Fail Fast Exception is a type of Exception made by User Mode applications.The Exception Code is 0xC0000409 (a.k.a. STATUS_FAIL_FAST_EXCEPTION).The first Exception Parameter (0) defines the Sub-Code. Some sub-codes use additional Exception Parameters to specify additional detail.Unlike all other exception codes, Fail Fast Exceptions bypass all exception handlers (frame or vector based). Raising this exception terminates the application and invokes Windows Error Reporting, if Windows Error Reporting is enabled.The Exception Code was initially designed to raise a security check failure. Specifically, Guard Segment (/GS) violations. Over time, the desire to have an immediate termination ability was leveraged by applications for non-security reasons. These applications leverage the first parameter to specify the scenario (a sub-code). The original "security check failure" use-case is reserved with a value of 0.The Exception Parameter values are currently not defined due to the per-application nature.The .exr and !analyze commands of the Debugger Tools for Windows provide a description when possible.Additional Resources:Inside - .exrInside - Windows SDKMSDN - RaiseFailFastException functionMicrosoft Docs - Debugging Tools for WindowsMicrosoft Docs - !gs commandMicrosoft Docs - Compiler Option - /GS (Buffer Security Check)Microsoft Docs - Compiler Option - /Gs (Control Stack Checking Calls)


    Read More

  • GitHub - p3Nt3st3r-sTAr/CVE-2026-41089: CVE-2026-41089 PoC — Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL)

    CVE-2026-41089 PoC — Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL) - p3Nt3st3r-sTAr/CVE-2026-41089


    Read More

  • Security Update Guide - Microsoft Security Response Center


    Read More

Related rules

to-top