CVE-2022-26831

Deeper analysis

CVE-2022-26831 is a denial-of-service vulnerability in the Windows Lightweight Directory Access Protocol (LDAP) component. It carries a CVSS 3.1 base score of 7.5 with a network attack vector, low attack complexity, and no required privileges or user interaction, resulting in high impact to availability while leaving confidentiality and integrity unaffected.

An unauthenticated remote attacker can send specially crafted LDAP requests over the network to trigger the flaw, causing the affected Windows system to become unresponsive or crash and thereby denying service to legitimate users. The vulnerability can be exploited without any prior access or credentials.

Microsoft has published guidance for the issue through its Security Response Center update guide at the referenced URLs, directing administrators to available patches and configuration steps for mitigation. The associated EPSS score has remained flat at a peak of 0.2180 with no material increase observed after disclosure.