What is the CVSS score of CVE-2026-41108?

CVE-2026-41108 has a contested CVSS base score of 7.0 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Microsoft Windows DNS are affected by CVE-2026-41108?

Microsoft Windows DNS servers are vulnerable to privilege escalation attacks by local users, allowing attackers to gain administrative control of critical DNS infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-41108?

Within 24 hours: Catalog all Windows DNS servers in production and staging environments; audit which systems have low-privileged user accounts with local logon access. Within 7 days: Restrict local logon capabilities on DNS servers to authorized administrators only; enable Windows Event Log auditing (Event ID 4688) for privilege escalation detection; implement privileged access management (PAM) controls if not already deployed. Within 30 days: Establish notification protocol with Microsoft for patch release; develop staged patching plan for deployment upon availability; conduct access review of any DNS systems with confirmed low-privilege access.

Microsoft Windows DNS CVE-2026-41108

EUVD-2026-35643 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-09 secure@microsoft.com

GHSA-xw2q-5wq4-7mx8

Heap Overflow Microsoft Buffer Overflow Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

High

Disputed · 7.0 Vendor: microsoft

Temporal: 6.1

Severity by source

Sources disagree (Medium–Critical)

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

CIRCL (temporal)

6.1 MEDIUM

cvss

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:36 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.0

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows DNS allows an authenticated low-privileged user to gain elevated privileges via a heap-based buffer overflow (CWE-122). The CVSS 7.0 score reflects high attack complexity and local-only access, and no public exploit is identified at time of analysis. The flaw was reported privately by Microsoft (MSRC) and is tracked under MSRC advisory CVE-2026-41108.

Technical ContextAI

The vulnerability resides in the Windows DNS component, which on workstation builds handles client-side resolution and on Windows Server typically backs Active Directory-integrated DNS zones. CWE-122 (Heap-based Buffer Overflow) indicates that input handled by the DNS code path is written past the bounds of a dynamically allocated buffer, corrupting adjacent heap metadata or object pointers. Successful manipulation of the corrupted heap can be steered into arbitrary code execution or token/structure overwrite, which on a service running with SYSTEM-level rights (as Windows DNS components typically do) yields full local privilege escalation.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-41108 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41108 as the primary fix; exact patched build numbers are published per-OS in that guide and should be matched to your Windows client and Windows Server inventory via WSUS, Intune, or SCCM. As compensating controls until patching completes, restrict interactive and remote logon to DNS-hosting servers to administrators only (limits the PR:L precondition), enforce LAPS and minimize local accounts on workstations to shrink the attacker pool, and on DNS servers consider temporarily disabling non-essential DNS features the advisory ties to the bug once Microsoft documents them - note this can break name resolution for dependent services such as Active Directory, so test in a maintenance window. Generic AppLocker / WDAC policies that block unsigned code from low-privileged contexts further raise the bar for staging the exploit but do not prevent the overflow itself.