EUVD-2026-56394
GHSA-6pr5-hpq7-qp74
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-only reachability (AV:A) limits internet exposure; no credentials or interaction required; full C/I/A impact consistent with unauthenticated RCE.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds write in Windows DNS allows an unauthorized attacker to execute code over an adjacent network.
AnalysisAI
Remote code execution in Windows DNS exposes a wide range of Windows Server and desktop systems to unauthenticated exploitation from adjacent network positions. Rooted in a CWE-787 out-of-bounds write triggered during DNS processing, the flaw carries a CVSS 8.8 score reflecting full confidentiality, integrity, and availability impact with no credentials or user interaction required. No public exploit identified at time of analysis, but a vendor-released patch is available and the broad affected version list - spanning Windows 10/11 and Server 2019 through 2025 - makes prioritized patching urgent for any environment where the DNS service is internet-edge or internally exposed.
Technical ContextAI
CWE-787 (Out-of-bounds Write) describes a memory corruption class where a component writes data beyond the boundary of an allocated buffer. In the context of Windows DNS - which handles both server-side DNS query processing and client-side DNS response parsing - a crafted DNS message can cause the resolver or server component to overwrite adjacent heap or stack memory, typically during packet parsing. DNS operates over UDP/53 and TCP/53, and the adjacent-network attack vector (AV:A per CVSS) indicates exploitation requires layer-2 or layer-3 adjacency (e.g., same VLAN, subnet, or logical link-local segment) rather than a globally routable path. This is consistent with either a rogue DNS server injecting malformed responses to a DNS client, or a local-network attacker sending malformed queries to a Windows DNS Server role. Tags reference 'Buffer Overflow' and 'Memory Corruption', confirming heap/stack smashing as the underlying mechanism. Affected builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2019, 2022, and 2025, including Server Core installations.
RemediationAI
Apply the Microsoft-released security update for the respective Windows version as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62817. Exact target build versions are: Windows Server 2025 - 10.0.26100.33296 or later; Windows Server 2022 - 10.0.20348.5499 or later; Windows Server 2019 - 10.0.17763.9115 or later; Windows 11 26H1 - 10.0.28000.2704 or later; Windows 11 24H2/25H2 - 10.0.26100.9168/10.0.26200.9168 or later; Windows 11 23H2 - 10.0.22631.7517 or later; Windows 10 22H2/21H2 - 10.0.19045.7663/10.0.19044.7663 or later. Where immediate patching is not possible, consider network segmentation to restrict adjacency - placing DNS servers in dedicated management VLANs with strict ACLs limits which hosts can reach UDP/TCP 53 on the DNS server. Note that DNS segmentation trades off client resolution latency and may require reconfiguring forwarder chains. For Windows DNS Server role instances, temporarily restricting DNS to TCP-only (disabling UDP) reduces the attack surface but is disruptive to resolver performance and not recommended as a long-term mitigation.
More in Windows 10 1809
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows contains an elevation of privilege vulnerability known as 'HiveNightmare' or 'SeriousSAM' where overly permissiv
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today