{"id":"CVE-2026-100222","published":"2026-10-13T19:17:42.587","lastModified":"2026-10-16T17:17:06.467","description":"Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-122","CWE-191"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100222","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap-based buffer overflow in Network Policy Server allows remote attackers to execute arbitrary code with high privileges. This vulnerability can be exploited without authentication and affects the core network access control functionality.","exploitability":"Exploitation is likely straightforward with a remote attacker able to send crafted packets to the NPS service, requiring no authentication or user interaction.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full control over network access policies and potentially compromise entire network infrastructure.","remediation":"No fixed version information is provided in the description, so implement network segmentation and restrict external access to NPS endpoints until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","network","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:47:25.575Z"}}