Windows Network Policy Server Heap Buffer Overflow Permits Unauthenticated Remote Code Execution
A critical buffer overflow in Network Policy Server lets attackers run code remotely on affected Windows versions without prior authentication.
Key points
- CVE-2026-100222 carries a CVSS score of 9.8 and is rated critical severity.
- The flaw involves a heap-based buffer overflow within the Network Policy Server component.
- Affected systems include specific builds of Windows 10 and Windows 11 prior to listed updates.
An attacker can execute code on a vulnerable Windows system by exploiting a heap-based buffer overflow in Network Policy Server (NPS). According to the National Vulnerability Database record for CVE-2026-100222, this vulnerability allows an unauthorized attacker to execute code over a network. The flaw enables remote access to trigger the overflow, permitting the execution of arbitrary code on the affected host without requiring prior authentication.
How it unfolded
- The National Vulnerability Database published the record for CVE-2026-100222, identifying a heap-based buffer overflow in NPS.
- The entry specifies that the weakness allows an unauthorized attacker to execute code over a network.
- The vulnerability is linked to CWE-122 and CWE-191, indicating a memory corruption issue within the server component.
Who is affected
Microsoft Windows 10 Version 1607 is affected if it runs builds before 10.0.14393.9612. Windows 10 Version 1809 is vulnerable before build 10.0.17763.9376. Windows 10 Version 21H2 and 22H2 are affected before build 10.0.19044.7807. Windows 11 version 23H2 is vulnerable before build 10.0.22631.7652. Organizations running these specific versions without the corresponding updates face exposure to this critical remote execution flaw.
The fix
No independent confirmation of a patch release exists in the provided source material. The NVD record lists specific build numbers as the threshold for safety, implying that systems running those versions or later are no longer vulnerable. Administrators should verify their current build numbers against the affected list to determine if their environment remains at risk.
What made it possible
Heap-based buffer overflows occur when a program writes more data to a memory segment than it can hold. In this scenario, the Network Policy Server fails to properly validate input size before allocating heap memory. This weakness allows an attacker to overwrite adjacent memory structures, potentially redirecting the execution flow. Such flaws typically serve as an initial access vector, allowing remote attackers to bypass authentication and gain a foothold on the network. Teams usually monitor network traffic for anomalous patterns that suggest exploitation attempts.
What to do and how to stay safe: Microsoft
- Verify the build version of all Windows servers running Network Policy Server against the affected list.
- Isolate NPS servers from untrusted networks until updates can be applied or mitigations are confirmed.
- Monitor authentication logs for unusual connection attempts or errors that may indicate exploitation.
- Ensure that remote management interfaces are restricted to authorized administrative IP addresses only.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-100222?
The National Vulnerability Database rates CVE-2026-100222 with a CVSS score of 9.8, which is critical severity.
Which Windows versions are affected by this NPS flaw?
Affected versions include Windows 10 1607, 1809, 21H2, 22H2, and Windows 11 23H2, depending on their specific build numbers.
Does the attacker need credentials to exploit this vulnerability?
No, the source material states that an unauthorized attacker can execute code over a network without authentication.
