CVE-2009-1139: Memory leak in the LDAP service in Active Directory on Microsoft Windows 2000 SP4 and Server 2003 SP2, and...

Security readout for executives and security teams

This is a legacy Microsoft directory-service denial-of-service issue. A remote attacker could send crafted LDAP or LDAPS requests that make vulnerable Active Directory or ADAM services leak memory, potentially causing service outage. The business risk is disruption to authentication and directory-dependent operations on unsupported or unpatched legacy systems. Exposure is most likely in environments still running Windows 2000, Windows Server 2003, Windows XP ADAM, or embedded/vendor products based on those platforms. Internet-exposed LDAP/LDAPS increases risk, but internal attackers could also disrupt directory services. Treat this as a legacy-risk cleanup item unless vulnerable directory services are still operational or exposed. If found on production authentication infrastructure, prioritize remediation because outages can affect logins, applications, and business operations broadly. Mitigation focus: Review and apply Microsoft MS09-018 guidance for affected systems.; Check Avaya advisory ASA-2009-214 for impacted Avaya products.; Restrict LDAP and LDAPS access to trusted networks only..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.