Windows DNS Server CVE-2026-88116

The target must have the Windows DNS Server role installed and reachable by the attacker. Exploitation is inferred to require the server to process an attacker-influenced DNS response - most plausibly a recursive/forwarding resolver that can be induced to query attacker-controlled records that trigger the untrusted pointer dereference during parsing. The UI:R metric is the key limiting factor: a triggering action or interaction is needed rather than a purely unsolicited inbound packet, which narrows opportunistic internet-wide exploitation. No authentication is required (PR:N). Affected builds span Windows Server 2016/2019/2022/2025 and Windows 10/11 client builds below the patched versions listed in EUVD; systems without the DNS Server role or already patched are not exposed.

This is a genuine high-priority vulnerability, though not quite emergency-tier. The CVSS 3.1 base score of 8.8 reflects network-reachable (AV:N), low-complexity (AC:L) code execution by an unauthorized attacker (PR:N) with full confidentiality/integrity/availability impact (C:H/I:H/A:H), tempered only by a user-interaction requirement (UI:R). The affected component - Windows DNS Server - is a high-value target because it is frequently co-located on Active Directory domain controllers, so code execution there can cascade into full domain compromise. Countervailing signals keep this below a drop-everything rating: no EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was identified, so exploitation status is 'no public exploit identified at time of analysis.' The vulnerability was reported privately by Microsoft's own security team (secure@microsoft.com), which is consistent with internal/coordinated discovery rather than observed in-the-wild attacks. One data conflict must be flagged: the input Tag 'Authentication Bypass' contradicts the CWE-822 (untrusted pointer dereference) classification and the description's 'execute code' impact - treat the tag as unreliable and the memory-corruption RCE framing as authoritative. Net: patch promptly, especially on internet-adjacent or recursive resolvers, but current data does not indicate active mass exploitation.

An attacker induces a vulnerable Windows DNS Server to process a maliciously crafted DNS response - for example by getting the server (acting as a recursive resolver) to query an attacker-controlled domain whose records trigger an untrusted pointer dereference during parsing. The UI:R metric indicates some triggering action or interaction is required rather than a fully passive packet drop, after which the attacker achieves arbitrary code execution in the DNS service context. No public exploit code was identified at the time of analysis.