LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089

title: LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089
id: f8a66a02-4a16-46e5-b7fd-a42c8a93d137
status: experimental
description: |
    Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409).
    This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability,
    which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service,
    leading to a stack-based buffer overflow and subsequent crash of the LSASS process.
references:
    - https://aretiq.ai/research/vul260513-cve-2026-41089-microsoft-windows-netlogon-buildsamlogonresponse-stack-based-buffer-overflow-rce/
    - https://learn.microsoft.com/en-us/shows/inside/c0000409
    - https://github.com/p3Nt3st3r-sTAr/CVE-2026-41089
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-06-02
tags:
    - attack.impact
    - attack.t1499
    - cve.2026-41089
    - detection.emerging-threats
logsource:
    product: windows
    service: application
detection:
    selection:
        Provider_Name: 'Application Error'
        EventID: 1000
        AppName: 'lsass.exe'
        ModuleName: 'netlogon.dll'
        ExceptionCode: 'c0000409' # STATUS_STACK_BUFFER_OVERRUN
    condition: selection
falsepositives:
    - Unknown
level: high