Saint LongLogon, of the Overlong Domain Name

Patron of domain controllers, domain names as long as an encyclical, and servers that reboot on their own.

Life

On 12 May 2026 Microsoft fixed CVE-2026-41089, a stack overflow in the Netlogon service reachable without authentication on domain controllers, scored 9.8 with possible code execution. The name comes from LongLogon, the tool released by Yeray Martín of ADscan after diffing the patch: the flaw is triggered in domain controller discovery and depends on the length of the domain name. In his lab it produced an LSASS crash and a controller reboot, not code execution.

Prayer

O Saint LongLogon, who trips over names that are too long, let our buffers measure before they copy. Amen.

How to celebrate

Celebrated by installing the May 2026 cumulative updates on domain controllers, without waiting for the spontaneous reboot.

Long name, short-lived controller.