EUVD-2026-56386
GHSA-vqwm-p8j6-626q
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
DNS is network-exposed (AV:N); use-after-free requires heap control conditions (AC:H); 'authorized attacker' implies low-privilege authentication (PR:L); code execution yields full C/I/A:H impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows DNS allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution via use-after-free in the Windows DNS service allows an authenticated, network-based attacker to execute arbitrary code on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025 and is exploitable over the network, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit identified at time of analysis; vendor-released patches with specific build targets are available via the Microsoft Security Response Center.
Technical ContextAI
CWE-416 (Use After Free) describes a memory safety flaw in which a program continues to use a pointer referencing memory that has already been freed. In the context of the Windows DNS service - a core network component handling DNS resolution and, on server editions, authoritative DNS serving - this type of flaw can allow an attacker to reclaim freed memory with controlled content and redirect code execution flow. The affected CPE surface spans Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809, indicating the flaw is present in a long-lived shared code path within the DNS subsystem. The CVSS vector (AV:N) confirms the vulnerability is exposed over the network, consistent with DNS being a network-facing service. The tags 'Memory Corruption' and 'Denial of Service' alongside 'Use After Free' suggest the flaw may have multiple exploitation outcomes depending on attacker control over memory layout.
RemediationAI
Vendor-released patches are available. Apply the following minimum build versions via Windows Update, WSUS, or Microsoft Update Catalog: Windows Server 2012 to 6.2.9200.26279 or later, Windows Server 2012 R2 to 6.3.9600.23337 or later, Windows Server 2016 and Windows 10 Version 1607 to 10.0.14393.9418 or later, Windows Server 2019 and Windows 10 Version 1809 to 10.0.17763.9115 or later, Windows Server 2022 to 10.0.20348.5499 or later, and Windows Server 2025 to 10.0.26100.33296 or later. Full advisory and patch links are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62787. As a compensating control prior to patching, restrict inbound DNS traffic (UDP/TCP port 53) to only known authorized client IP ranges using host-based firewall rules or network ACLs - note this may disrupt legitimate DNS resolution for clients outside the allowlist. Additionally, isolate DNS servers in a dedicated network segment to limit attacker reachability, accepting the trade-off of increased network complexity.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today