EUVD-2026-100158
GHSA-5gcx-hj43-wrg3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privilege network access
-
ExploitSend crafted DNS message to server
-
ExecutionTrigger out-of-bounds read in DNS Server
-
ImpactCrash service and deny name resolution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Windows DNS Server role to be installed and reachable over the network, plus a low level of pre-existing authorization/privilege (PR:L) - it is NOT unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The impact is limited to availability (service crash / loss of DNS resolution); there is no confidentiality or integrity impact (C:N/I:N). Affected deployments are unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations) below the fixed build numbers listed in the EUVD data; patched builds are available from Microsoft and remediate the condition. |
| Impact | This is a moderate, not top-tier, priority. The CVSS 3.1 base vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5) describes a network-reachable, low-complexity attack that requires low-level privileges (PR:L) and causes a pure availability impact (C:N/I:N/A:H) - consistent with an out-of-bounds read (CWE-125) crashing the Windows DNS Server service. SSVC reinforces a measured posture: Exploitation=none, Automatable=no, Technical Impact=partial, which argues against mass or wormable abuse. No EPSS score was provided, and the CVE is NOT in CISA KEV; there is no public exploit identified, so active exploitation is not indicated. The signals are mutually consistent (authenticated DoS, hard to automate, no observed exploitation) rather than conflicting. Note a tension between the CVSS metrics and the input Tags: the vector shows C:N (no confidentiality loss) yet the tags claim 'Information Disclosure' - the metrics indicate this is a denial-of-service bug, not an info-leak, and the tag appears mislabeled. |
| Exploit ScenarioDerived | An attacker who already holds low-privilege network access to an environment sends a specially crafted DNS query or response to an affected Windows DNS Server, triggering an out-of-bounds read that crashes the service and disrupts name resolution for the domain. No public exploit code has been identified, and exploitation requires some level of authorization (PR:L), limiting opportunistic use. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read in the Microsoft Windows DNS Server role lets a remote attacker who already holds a low level of authorization (PR:L, per the assessed CVSS vector) crash or destabilize the DNS service, denying name resolution to clients on the network. The flaw affects unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations), and exploitation requires the DNS Server role to be installed and reachable. Impact is availability-only (C:N/I:N/A:H) with no confidentiality or integrity effect, no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no' - a moderate, not top-tier, priority. Microsoft has released fixed builds.
RemediationAI
Vendor-released patch: apply the Microsoft security update for CVE-2026-88129, which raises each branch to the fixed builds - Windows Server 2022 to 10.0.20348.5761, Windows Server 2025 to 10.0.26100.33650, Windows Server 2016 to 10.0.14393.9612, Windows Server 2019 to 10.0.17763.9376, Windows Server 2012 to 6.2.9200.26434, and Windows Server 2012 R2 to 6.3.9600.23470 - per the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88129. Note that Windows Server 2012 and 2012 R2 are out of mainstream support, so verify Extended Security Update eligibility before depending on that build; if the server is a domain controller, patch during a controlled maintenance window with DNS replication health checks afterward. Where patching must be deferred (legacy 2012/2012 R2 hosts, change-freeze periods for domain controllers), compensating controls should target the PR:L prerequisite and network reachability of port 53: restrict DNS port 53 (UDP and TCP) to known client and secondary-server/forwarder subnets with host or network firewall rules, and remove unnecessary DNS management permissions so low-privileged accounts cannot reach the trigger as easily - the trade-off is that tightly scoping DNS traffic can break roaming clients, conditional forwarders, and zone transfers, so validate the rule set against your zone replication topology first. Disabling the DNS Server role entirely removes exposure but is not viable on domain controllers. Because SSVC exploitation is 'none', automatable is 'no', and no public exploit is identified, these measures are prudent hardening rather than emergency mitigations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 11 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-125 (Out-of-bounds Read) in the Windows DNS Server service, the component that resolves and forwards DNS queries for a Windows domain. DNS is a UDP/TCP-based protocol on port 53 whose message parser handles attacker-supplied packet fields (labels, resource records, compression pointers), so a parsing logic error that reads past the end of an allocated buffer is reachable from network input. Notably, the supplied reference tags also mention 'Buffer Overflow' and 'Information Disclosure', but the authoritative assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) records no confidentiality or integrity impact, so the practical, demonstrated effect here is a service-level availability failure (crash / loss of DNS resolution) rather than memory disclosure. Because PR:L is present in the vector, this is not an unauthenticated primitive: the attacker needs some pre-existing authorization on the target or a position that satisfies that privilege requirement, and AC:L/UI:N mean it can be triggered without special timing or user involvement once those prerequisites are met. The affected component is present whenever the DNS Server role is installed, which is common on Active Directory domain controllers and dedicated DNS hosts.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable DNS service (AV:N) with low complexity (AC:L); 'authorized attacker' and PR:L indicate low privilege required; out-of-bounds read yields pure availability loss (C:N/I:N/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB