CVE-2026-41089 — Microsoft Windows Netlogon BuildSamLogonResponse Stack-based Buffer Overflow RCE

LDAPNightmare, a SafeBreach Labs proof of concept for CVE-2024-49113, coaxes a Windows host, including a domain controller, into crashing via crafted LDAP responses from an attacker-controlled server.

Zerologon (CVE-2020-1472) exploits Netlogon to bypass authentication and reset a domain controller's machine account password, granting full domain control. Detection: Event ID 4742.

Takeaways from Zerologon (CVE-2020-1472): the Netlogon flaw let unauthenticated attackers reset a domain controller's password and seize domain admin rights—CVSS 10, exploits circulating—plus CISA's patch order and Microsoft's two-phase fix.

CVE-2026-3593: a use-after-free in BIND 9's DoH implementation—freed response buffers are read during HTTP/2 SETTINGS floods, crashing ASAN builds; fixed in 9.20.23 and 9.21.22.

Positive Technologies details two PHP PDO flaws: CVE-2025-14179, SQL injection in pdo_firebird via NUL bytes in quoted strings, and CVE-2025-14180, a NULL pointer dereference in PDO quoting.

An integer overflow in PostgreSQL libpq's PQescapeInternal() makes it allocate too little and write hundreds of MB past the buffer, segfaulting applications — a denial-of-service vulnerability.