## Patch Tuesday Composition

Microsoft's May 2026 security update batch resolves 137 unique CVEs across the Microsoft product portfolio. After filtering out Mariner Linux distribution, Azure dataplane, Copilot, Teams, and Partner Center advisories — the slice BleepingComputer counts separately — the core Microsoft surface accounts for 120 vulnerabilities. The severity composition is heavily weighted toward privilege escalation (61 EoP) but the operationally relevant slice for external defenders is the 31 Critical entries, 16 of which permit Remote Code Execution and a handful of which are reachable without authentication. Cisco Talos confirms that none of the disclosed vulnerabilities were observed in active exploitation at release, and Microsoft tagged no entries with Exploited:Yes in MSRC. This drops the immediate urgency below the historical 'pure CRITICAL' bar reserved for in-the-wild zero-days while preserving HIGH urgency due to the pre-auth Netlogon and DNS Client RCEs.

## CVE-2026-41089 — Netlogon Pre-Auth Stack Overflow (CRITICAL, CVSS 9.8)

A stack-based buffer overflow (CWE-121) in the Windows Netlogon service permits an unauthenticated network attacker to execute code on a Windows server operating as a domain controller via a specially crafted Netlogon network request. The flaw is structurally similar to the historical Zerologon (CVE-2020-1472) and Netlogon RPC family of issues that have repeatedly been weaponized for domain takeover. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector indicates a complete pre-auth network compromise primitive: any unauthenticated host with network reachability to the DC's RPC interface (typically tcp/445 SMB, tcp/135 EPM, tcp/49152-65535 dynamic RPC) can trigger the overflow. Stack overflows in lsass-hosted services on modern Windows still face mitigations (stack cookies/GS, CFG, ASLR, DEP), but successful exploitation results in code execution in the security context of the Netlogon service — effectively SYSTEM on the DC, equating to immediate Domain Admin equivalence. The Talos write-up explicitly highlights this as the headline flaw of the release. Cisco published Snort coverage in SIDs 1:66438-1:66445 and 1:66451-1:66460 (Snort 2) and 1:301494-1:301497 / 1:301500-1:301506 (Snort 3) covering the May batch network-protocol primitives, with overlapping detection logic for the Netlogon, DNS, and SharePoint RCEs.

## CVE-2026-41096 — Windows DNS Client Heap Overflow (CRITICAL, CVSS 9.8)

A heap-based buffer overflow (CWE-122) in the Windows DNS Client triggers when the client parses a maliciously crafted DNS response. The attack model: any system path that causes the target Windows host to perform a DNS resolution against an attacker-controlled or attacker-influenced authoritative server — including environments where DNS resolution can be coerced (link resolution in Office documents, MoTW-bypassing URLs, captive portals, attacker-poisoned LAN with rogue DHCP supplying a malicious DNS server) — results in heap corruption inside dnsapi/dnsrslvr code paths and unauthenticated code execution. Because the DNS Client is invoked transparently during virtually every networked operation, the exposure is exceptionally broad. Pre-auth network attack vector with no user interaction (AV:N/UI:N) and SYSTEM-level service host context elevate this to the same operational risk band as the Netlogon flaw, though exploitation requires the target to issue a DNS request the attacker can answer.

## CVE-2026-35421 — Windows GDI EMF Heap Overflow (CRITICAL, CVSS 7.8)

A heap-based buffer overflow (CWE-122) in the Windows GDI subsystem is reachable when a user opens or otherwise processes a specially crafted Enhanced Metafile (EMF) using Microsoft Paint. Local AV:L with UI:R reduces the headline CVSS, but EMF parsing surfaces also include the Explorer thumbnail pipeline and Office image insertion paths, broadening practical exposure beyond Paint. Successful exploitation grants code execution in the user's context and is a classic single-click drive-by attachment primitive that pairs well with phishing (T1566.001) and User Execution (T1204.002).

## CVE-2026-40365 — SharePoint Server Authenticated RCE (CRITICAL, CVSS 8.8)

Insufficient granularity of access control (CWE-1220) in Microsoft SharePoint Server permits a low-privileged authenticated user to perform a network-based attack that remotely executes code on the SharePoint server. The vector matches the high-value SharePoint exploitation lineage (ToolShell, CVE-2024-38094, CVE-2025-49706/49707), targeting on-prem SharePoint deployments that frequently service Office automation, ETL connectors, and AD-integrated SSO — making them stepping stones into broader enterprise compromise.

## CVE-2026-32161 — Native WiFi Miniport Driver Adjacent RCE (CRITICAL, CVSS 7.5)

A concurrent-execution race condition (CWE-362) combined with a use-after-free (CWE-416) in the Windows Native WiFi Miniport Driver permits an attacker on an adjacent network (AV:A) to execute code in the kernel-mode driver context with no authentication. Exploitation primitives in wireless miniport drivers historically yield ring-0 code execution, bypassing user-mode mitigations entirely. Operationally relevant to laptops in coffee-shop, conference, and airport environments — the classic 'evil twin AP' adjacent-attack model. AC:H reflects the timing/race precision required, but successful PoCs in this driver family have appeared rapidly in the past (e.g., CVE-2022-21893, CVE-2024-30078).

## CVE-2026-40403 — Win32k Graphics Component Local EoP (CRITICAL, CVSS 8.8)

A heap-based buffer overflow (CWE-122) in the Win32k graphics component grants an authenticated local attacker the ability to execute code at the kernel level (Scope:Changed reflecting the user-to-kernel boundary jump). Win32k EoP primitives are the post-exploitation backbone of nearly every modern Windows malware sample and the historical target of Kaspersky, ESET, and CrowdStrike-tracked Win32k zero-days. Combined with any of the user-context RCEs in this batch (Office, GDI), this provides a complete user-to-SYSTEM chain.

## CVE-2026-42898 — Dynamics 365 On-Premises Code Injection (CRITICAL, CVSS 9.9)

Improper control of code generation (CWE-94, code injection) in Microsoft Dynamics 365 on-premises permits an authorized low-privilege attacker (PR:L) to inject and execute arbitrary code over the network with Scope:Changed impact. Dynamics 365 deployments commonly run with elevated service accounts integrated into Active Directory, SQL Server, and SSRS — code execution here typically transitively reaches connected database and AD assets.

## CVE-2026-33109 / CVE-2026-33844 — Azure Managed Instance for Apache Cassandra (CRITICAL, CVSS 9.9 / 9.0)

Improper access control (CWE-284) and improper input validation (CWE-20) in the Cassandra managed-service surface allow an authenticated attacker to escape the tenant boundary and execute code in the managed-service context, with Scope:Changed indicating multi-tenant impact. Patched by Azure platform — customer action is awareness rather than remediation.

## Office / Word Critical RCE Cluster (CVE-2026-40358, 40361, 40363, 40364, 40366, 40367, 42831)

A cluster of seven critical Office/Word RCEs combines use-after-free (CWE-416), heap overflow (CWE-122), type confusion (CWE-843), and untrusted pointer dereference (CWE-822) primitives. All are AV:L (local file open), but the preview-pane and Outlook auto-render attack surfaces make these effectively one-click in operational practice. The cluster is the standard monthly Office harvest used by mass-distribution droppers (Emotet/Qakbot lineage) and APT spearphishing (Storm-1811, Cobalt Mirage observed reusing prior Office CVEs within 14-30 days of disclosure).

## Patch Reference Numbers

- Windows 11 23H2/24H2: KB5089549, KB5087420 - Windows 10 Extended Support: KB5087544

## Defensive Priority Order

1. Patch domain controllers immediately to remediate CVE-2026-41089. Until patched, restrict RPC dynamic-port access and enforce Netlogon secure channel signing+sealing. 2. Patch Windows endpoints to remediate CVE-2026-41096; harden DNS resolver path by enforcing DoH/DoT or fixed trusted resolvers. 3. Patch SharePoint, Office/Word, and Win32k components on high-value workstations and document servers. 4. Patch WiFi-enabled mobile fleet before next off-premises travel cycle. 5. Deploy Talos Snort coverage SIDs 1:66438-66476 and Snort 3 1:301494-301506 on network sensors.