LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409). This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability, which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service, leading to a stack-based buffer overflow and subsequent crash of the LSASS process.

2026-06-02 00:00:00

None

f8a66a02-4a16-46e5-b7fd-a42c8a93d137

attack.impact attack.t1499 cve.2026-41089 detection.emerging-threats

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #6041 from @swachchhanda000 - Add `LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089`

2026-06-11