What is cve-2026-41089?

This Python project is a proof-of-concept exploit for CVE-2026-41089, a security vulnerability in Windows Server that Microsoft disclosed and patched in May 2026. The vulnerability received a CVSS score of 9.8 out of 10, which is classified as critical. A proof-of-concept, in security research terms, is a minimal working demonstration of a flaw, used to confirm the vulnerability is real and to help defenders understand what they are protecting against. The flaw lives in a Windows component called Netlogon, which domain controllers use to handle authentication on a corporate network. A domain controller is the server that manages user logins and access permissions for a Windows-based organization. The bug allows anyone to crash that server by sending a single specially crafted network packet to port 389, without needing any username or password. The crash causes Windows' security process to restart, which reboots the domain controller and disrupts the entire organization's network access for roughly a minute. The README explains this happens because a function that writes data into a fixed-size memory buffer mistakes a character count for a byte count, causing it to write roughly twice as much data as expected and overflow the buffer. The proof-of-concept script takes a target IP address and domain name, sends a test ping to confirm the server is reachable, then sends the oversized packet, and checks afterward whether the server stopped responding. Running it requires Python 3.8 or later and no additional packages. Every version of Windows Server acting as a domain controller is affected. Fixed versions are listed for Windows Server 2016, 2019, 2022, and 2025. The fix is to install the May 2026 Microsoft security update. The README also recommends blocking outside access to port 389 and mentions a third-party micropatch for older server versions no longer receiving official updates. The README states this code is intended only for authorized security research and education, and that testing it against systems without written permission violates computer crime laws. It is released under the MIT license.