EUVD-2026-29684
GHSA-9pgv-xqpg-75rv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable DNS parsing with no auth or user interaction (AV:N/AC:L/PR:N/UI:N) and heap-overflow RCE yielding total impact (C/I/A:H) per SSVC total technical impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.
Articles & Coverage 1
AnalysisAI
Remote code execution in Microsoft Windows DNS lets an unauthenticated attacker corrupt heap memory over the network and run arbitrary code on affected Windows 11 (22H3 through 26H1) and Windows Server 2022/2025 systems. The flaw is a CWE-122 heap-based buffer overflow rated CVSS 9.8, reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%), so this is a high-severity but not-yet-exploited issue. CISA SSVC flags it as automatable with total technical impact, meaning successful exploitation fully compromises the host.
Technical ContextAI
The vulnerability is a heap-based buffer overflow (CWE-122) in the Windows DNS component, the service that resolves and, on Windows Server, can serve DNS records for a domain. Heap overflows occur when data written to a dynamically allocated buffer exceeds its bounds, corrupting adjacent heap metadata or objects and enabling an attacker to steer allocator behavior toward controlled code execution. The affected CPEs cover client Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1) and Windows Server 2022 (23H2 Server Core) and Windows Server 2025 including Server Core installations, indicating the flawed parsing/handling code is shared across the current Windows DNS codebase. Because DNS message parsing is reachable over the network, malformed DNS traffic (queries or responses depending on role) is the likely trigger surface, consistent with the AV:N/PR:N/UI:N vector.
RemediationAI
Apply the Microsoft security update for CVE-2026-41096 (Vendor-released patch: install the cumulative update that brings each build to at least the fixed version - Windows 11 22H3/23H2 to 10.0.22631.7079, 24H2 to 10.0.26100.8457, 25H2 to 10.0.26200.8457, 26H1 to 10.0.28000.2113, Windows Server 2022 23H2 Server Core to 10.0.25398.2330, and Windows Server 2025 to 10.0.26100.32860), following the guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096. Patching is the primary and recommended fix. If patching must be delayed on DNS servers, compensating controls include restricting inbound DNS (UDP/TCP 53) to trusted resolvers and forwarders and blocking untrusted networks from reaching the DNS Server role at the firewall, which reduces the network attack surface but can break legitimate external resolution if the host is an authoritative or public resolver; on clients, limiting which DNS servers hosts will query (trusted internal resolvers only) reduces exposure to malicious responses but does not eliminate risk if the trusted path is compromised. Because the exact vulnerable role is not confirmed in the available data, verify the applicable mitigation against the MSRC advisory before relying on it.
More in Windows 11 Version 22H3
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in Microsoft Windows Hyper-V (Windows 11 22H3/23H2 and Windows Server 2022) stems from a use-
Windows Shell security feature bypass enables unauthenticated remote attackers to defeat protection mechanisms across al
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an already-authenticate
Local privilege escalation in Windows Kernel across Windows 10, Windows 11 (versions 22H3 through 26H1), and Windows Ser
Local privilege escalation in the Windows Remote Desktop component (CWE-122 heap-based buffer overflow) allows an authen
Local privilege escalation in the Win32K GRFX (graphics) subsystem of Microsoft Windows allows an authenticated, low-pri
Windows Snipping Tool leaks sensitive information to unauthenticated network attackers via user interaction, enabling sp
Remote code execution in the Microsoft Windows TCP/IP stack allows an unauthenticated network attacker to trigger a use-
Remote code execution in Windows TCP/IP networking stack across Windows 10, 11, and Server versions allows unauthenticat
Local privilege escalation in the Windows Projected File System (ProjFS) affects the full supported Windows line — Windo
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today