← Vulnerability feed

Vulnerability record · CVE-2024-49112 · published 12 December 2024

CVE-2024-49112: Windows LDAP integer overflow allows remote code execution

Microsoft · Windows 10 1507

Windows LDAP contains an integer overflow (CWE-190) that can be triggered remotely and leads to remote code execution. The flaw is rated critical (CVSS 9.8) and affects a broad set of Windows client and server releases, so unpatched domain controllers and LDAP-exposed hosts are at serious risk.

9.8 CVSS 3.1 Critical EPSS 72% · top 0.6% CWE-190 · Integer overflow
9.8CVSS 3.1 base score
72%EPSS exploitation probability, 30 days
NoNot in CISA KEV
14Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network, unauthenticated, no-interaction RCE on widely deployed Windows LDAP services, plus very high EPSS, warrants critical priority despite no KEV listing.

What it is

Windows LDAP contains an integer overflow (CWE-190) that can be triggered remotely and leads to remote code execution. The flaw is rated critical (CVSS 9.8) and affects a broad set of Windows client and server releases, so unpatched domain controllers and LDAP-exposed hosts are at serious risk.

Impact

A remote, unauthenticated attacker can execute arbitrary code on the target, potentially taking full control of a domain controller or other LDAP service host.

Attack surface

Reachable over the network via the LDAP service with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any host running the affected Windows LDAP implementation is exposed.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high (0.719, 99.4th percentile), indicating elevated likelihood of exploitation activity.

What to do

  • Apply the Microsoft security update for CVE-2024-49112 on all affected Windows versions, prioritizing domain controllers and LDAP servers.
  • Restrict network access to LDAP (TCP 389/636) to trusted management networks and block it from untrusted segments.
  • Enable and monitor LDAP signing and channel binding to reduce exposure to LDAP-based attacks.
  • Segment and harden domain controllers, and monitor for anomalous LDAP traffic or crashes.
  • Track vendor advisories for updated guidance and any signs of active exploitation.

Detection

  • Monitor LDAP service crashes or unexpected restarts on domain controllers and member servers.
  • Alert on unusual LDAP query patterns or malformed LDAP requests from untrusted sources.
  • Review Windows event logs and network telemetry for anomalous LDAP traffic to TCP 389/636.
  • Correlate host-based indicators of code execution on LDAP-exposed systems with inbound LDAP connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

14 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49112 Vendor Advisory

Track CVE-2024-49112 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-33824Double free in Windows IKE Extension enables remote code executionA double free flaw (CWE-415) exists in the Windows IKE Extension, reachable over the network by an unauthenticated attacker. Successful exploitation …KEVEPSS 1.6%analysed9.8CVE-2017-8543Windows Search memory handling flaw allows remote code executionWindows Search fails to properly handle objects in memory, allowing an unauthenticated remote attacker to execute code on affected Windows systems. T…KEVEPSS 74%analysed8.8CVE-2026-21510Windows Shell protection mechanism failure allows security feature bypassWindows Shell contains a protection mechanism failure (CWE-693) that lets an unauthorized attacker bypass a security feature over a network. The flaw…KEVEPSS 24%analysed8.8CVE-2026-21513Microsoft MSHTML security feature bypass on WindowsCVE-2026-21513 is a protection mechanism failure (CWE-693) in the Microsoft MSHTML Framework that lets an unauthorized attacker bypass a security fea…KEVEPSS 16%analysed8.8CVE-2025-33073Windows SMB improper access control allows privilege elevationWindows SMB contains an improper access control flaw (CWE-284) that lets an authorized attacker elevate privileges over the network. Microsoft rates …KEVEPSS 83%analysed8.8CVE-2025-33053Microsoft Windows WebDAV Internet Shortcut File Path Control RCEWindows Internet Shortcut (.url) files allow external control of a file name or path, which an unauthorized attacker can abuse to execute code over a…KEVEPSS 87%analysed8.8CVE-2024-49039Windows Task Scheduler elevation of privilege via improper authenticationCVE-2024-49039 is an elevation of privilege flaw in the Windows Task Scheduler, classified as improper authentication (CWE-287). A local attacker wit…KEVEPSS 14%analysed8.8CVE-2024-43461Windows MSHTML Platform spoofing flaw enables code executionCVE-2024-43461 is a spoofing vulnerability in the Windows MSHTML platform, the legacy rendering engine still reachable through Windows components. Th…KEVEPSS 54%analysed

Source: NIST National Vulnerability Database (record CVE-2024-49112), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.