CVE-2026-69809: CWE-401: Missing Release of Memory after Effective Lifetime in Microsoft Windows 11 version 23H2

This vulnerability, identified as CWE-401 (Missing Release of Memory after Effective Lifetime), exists in Active Directory Domain Services on Microsoft Windows 11 version 23H2. It allows an unauthorized attacker to trigger a denial of service condition remotely by causing memory to not be released properly after use, leading to resource exhaustion. The issue affects several Windows 11 23H2 builds, with patches released to address the problem. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service).

An attacker can remotely cause a denial of service by exploiting the missing memory release, leading to resource exhaustion in Active Directory Domain Services. This does not impact confidentiality or integrity but can disrupt availability of affected systems.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Windows 11 version 23H2 to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69809 for update details and guidance.