EUVD-2026-100155
GHSA-fqq6-qpmv-69gj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege network access
-
DeliverySend crafted DNS message to server
-
ExploitTrigger out-of-bounds read in parser
-
ExecutionCrash DNS service
-
ImpactDeny name resolution to clients
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Windows DNS Server role to be running and reachable over the network, plus at least low-level authorization (PR:L) - the attacker must be an authorized actor able to submit DNS messages to the service, not an anonymous internet client. No user interaction is required (UI:N). The limiting factors are the PR:L authentication requirement and the restriction to systems actually running the DNS Server role on affected Windows Server builds (Server 2012 through 2025, including Server Core); default workstation installs are not affected. Impact is confined to availability (service crash/DoS); there is no confidentiality or integrity compromise. |
| Impact | This is a moderate-priority availability flaw, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) shows a network-reachable, low-complexity attack but one that requires at least low-level privileges (PR:L), limiting it to authorized/authenticated actors rather than anonymous internet attackers. Impact is availability-only (C:N/I:N/A:H) - a denial of service, consistent with an out-of-bounds read (CWE-125) in the Windows DNS Server. Corroborating signals point to low urgency: CISA SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. There is no CISA KEV listing and no EPSS score or public POC provided in the input, so there is no evidence of active exploitation. Note a conflict to verify: the input Tags include 'Information Disclosure', but the CVSS vector sets C:N (no confidentiality impact) and the description states a denial of service - the information-disclosure characterization is not supported by the metrics. Overall this is a legitimately patchable issue for DNS infrastructure but reads as a high-CVSS-adjacent, low-real-risk DoS rather than a widespread exploitation threat. |
| Exploit ScenarioDerived | An attacker who already holds low-level authorized access to a network path reaching an affected Windows DNS Server sends a specially crafted query or malformed DNS message that triggers an out-of-bounds read in the server's parsing logic. The resulting crash or unhandled fault denies DNS resolution service to dependent clients. No public exploit code is identified at time of analysis, and the low CVSS attack complexity (AC:L) means a working trigger would be reliable once discovered. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who is already authorized to send DNS messages to the service trigger a denial of service over the network, degrading or crashing the DNS service on affected Windows Server builds. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning it is remotely reachable without user interaction but requires at least low-level authorization - the attacker must be an authorized actor able to submit DNS queries, not an anonymous internet client - and the impact is confined to availability with no confidentiality or integrity loss. Affected systems are Windows Server 2012 through Windows Server 2025, including Server Core installations, that are actually running the DNS Server role; default workstation installs are not affected. Vendor patches are available for all affected builds, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording exploitation as none and the vulnerability as not automatable.
RemediationAI
Apply the vendor-released patch: install the Microsoft update that brings each build to or above the fixed level - Windows Server 2012 to 6.2.9200.26434, Windows Server 2012 R2 to 6.3.9600.23470, Windows Server 2016 to 10.0.14393.9612, Windows Server 2019 to 10.0.17763.9376, Windows Server 2022 to 10.0.20348.5761, and Windows Server 2025 to 10.0.26100.33650 - following the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88122. Because exploitation requires an authorized actor who can submit DNS messages, reducing that reach removes the prerequisite: restrict UDP/TCP 53 access so only trusted resolvers, forwarders, and managed client subnets can query the server, which shrinks the pool of hosts that can trigger the out-of-bounds read but requires an accurately maintained ACL/firewall inventory and can break legitimate clients or dynamic-update workflows if applied too tightly. Where the DNS role is not needed on a given host, uninstall it to eliminate the attack surface entirely - a safe and irreversible-by-design reduction, though it requires DNS duties to be relocated first. On multi-homed DNS servers, avoid exposing the service to untrusted or guest network segments, and consider running the DNS service account under least privilege to limit fallout from any service crash. Renaming or filtering malformed query types is not a reliable control here because the defect is in core message parsing rather than in a specific record type, and any such filtering carries a risk of dropping legitimate traffic; patching remains the only complete fix. Monitor DNS service restarts, unexpected event log terminations, and resource exhaustion alerts as detection signals, since exploitation manifests as availability loss rather than data theft.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 11 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-125 out-of-bounds read in the Windows DNS Server service - the component that listens on UDP/TCP port 53 and parses wire-format DNS messages into internal structures before answering queries or resolving names. The root-cause class is improper bounds validation of a length or offset field during message parsing, so a crafted DNS packet can cause the service to read memory beyond the end of an allocated buffer. Because the CVSS vector specifies AV:N/AC:L/PR:L/UI:N with only A:H (C:N/I:N), the practical consequence is a memory-safety fault that terminates or destabilizes the DNS service rather than disclosing memory contents or allowing writes; the accompanying tag of 'Information Disclosure' should be treated as a parser symptom descriptor, not as a confirmed confidentiality impact, since our independent assessment keeps C:N and I:N. Exploitation prerequisites are narrow: the DNS Server role must be installed and reachable over the network and the attacker must be an authorized actor able to submit DNS messages (PR:L). The service is reachable by any client that the server accepts queries from, which for typical recursive or AD-integrated deployments can include a large internal population. The EUVD data ties the flaw to specific Windows Server servicing builds (6.2.9200.x, 6.3.9600.x, 10.0.14393.x, 10.0.17763.x, 10.0.20348.x, 10.0.26100.x), and SSVC rates technical impact as partial and exploitation as none.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable DNS service with low-complexity trigger but requiring authorized access (PR:L); out-of-bounds read yields a crash so availability-only impact (A:H), no C/I.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB