EUVD-2026-100156
GHSA-h3m9-5wvp-m8hq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain authorized network access to DNS service
-
DeliverySend crafted DNS message
-
ExploitTrigger out-of-bounds read (CWE-125)
-
ExecutionCrash or hang DNS Server process
-
ImpactDeny name resolution to clients
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the Windows DNS Server role (the DNS service must be installed and running, as it is on most Active Directory domain controllers) and holding some authorized access on the network, consistent with CVSS PR:L - this is not an unauthenticated internet-facing attack. The limiting factors are: the attacker needs valid low-level privileges/authorization (per PR:L), the DNS Server role must be enabled, and the host must be an unpatched version below the fixed builds (e.g., Server 2025 <10.0.26100.33650, Server 2022 <10.0.20348.5761, Server 2019 <10.0.17763.9376, Server 2016 <10.0.14393.9612, Server 2012 R2 <6.3.9600.23470, Server 2012 <6.2.9200.26434). Impact is limited to availability (service crash/DoS); there is no code execution, data disclosure, or integrity impact. |
| Impact | This is a moderate-severity, low-urgency issue, and the available signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable but authenticated (PR:L) denial-of-service with no confidentiality or integrity impact - a CWE-125 out-of-bounds read in the Windows DNS Server role that crashes or hangs the service. CISA's SSVC decision framework reinforces low priority: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-exploited), and Technical Impact=partial (service disruption, not full takeover). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis. The one point worth verifying is the authentication requirement: the description's phrase 'authorized attacker' aligns with the CVSS PR:L, meaning an attacker needs some valid access/privilege on the network to reach and trigger the flaw - this materially lowers real-world risk versus an unauthenticated DNS bug. Net: a legitimate patch-management item (availability risk to a core infrastructure service) but not a drop-everything emergency. |
| Exploit ScenarioDerived | An attacker with low-level authorized network access (PR:L) sends a crafted DNS query or response to a vulnerable Windows DNS Server, triggering an out-of-bounds read that crashes or hangs the service and denies name resolution to dependent clients. Because DNS underpins Active Directory and general connectivity, an outage can cascade across an enterprise. No public exploit code is identified at time of analysis, and SSVC rates it non-automatable, so opportunistic mass exploitation is unlikely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorized access on the network crash or degrade the DNS service, resulting in a denial of service. The flaw affects unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds, and because the DNS role runs on most Active Directory domain controllers, any environment with an exposed or reachable DNS service should treat those hosts as in scope. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) the attacker must be authenticated with low privileges, exploitation is over the network, and impact is limited to availability with no code execution or data disclosure; CISA's SSVC assessment records no observed exploitation and no public exploit code, so this is a moderate-severity, patch-cycle issue rather than an emergency.
RemediationAI
Apply the Microsoft updates that raise each affected build to or above the fixed levels: Windows Server 2025 10.0.26100.33650, Windows Server 2022 10.0.20348.5761, Windows Server 2019 10.0.17763.9376, Windows Server 2016 10.0.14393.9612, and Windows Server 2012 R2 6.3.9600.23470 / Windows Server 2012 6.2.9200.26434. Microsoft reports a vendor patch is available and the update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88123 should be used to confirm the specific KB for each branch, since the 2012-era releases are on extended support and may require ESU entitlement. Because the vector is AV:N/AC:L/PR:L and impact is availability-only, no single configuration workaround fully removes exposure; the most effective compensating control is to restrict who can send DNS queries and DNS update/dynamic-update traffic to the server - for example, limit zone transfer and dynamic update to authorized subnets or secure-only dynamic updates, and block DNS (TCP/UDP 53) from untrusted client networks - at the cost of breaking name resolution for legitimate clients outside those ranges and potentially disrupting third-party integrations. Disabling the DNS Server role outright eliminates exposure but is generally not viable on domain controllers, since it would break Active Directory; where a DC cannot be patched immediately, isolating it behind host firewalls to only the management and client subnets that require it narrows the attack surface but adds latency for remote clients. Monitor DNS service crashes (dns.exe faults) and unexpected restarts as an indicator of attempted exploitation until patching completes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 11 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-125 out-of-bounds read inside the Windows DNS Server service, which is a core networking role shipped with every supported Windows Server release and enabled by default on Active Directory domain controllers. DNS parsing code reads length or offset fields supplied in network messages and, in the vulnerable builds, can index past the end of a buffer when handling a crafted request; the resulting memory access faults the DNS service rather than returning attacker-controlled data, matching the assigned impact of availability-only (C:N/I:N/A:H) rather than confidentiality or integrity loss. The AV:N vector confirms the DNS listener is reachable remotely, but PR:L means the attacker must already possess some authorized access on the network - this is not an unauthenticated internet-facing DNS flood or amplification scenario, and the AC:L rating indicates no special conditions beyond holding that access are needed. The same CWE-125 class is frequently described alongside tags such as "Buffer Overflow" and "Information Disclosure" in vendor metadata, but in this instance the absence of C/I impact in the assessed vector constrains the real-world consequence to service disruption of the DNS role itself, which on a domain controller can cascade into authentication and name-resolution failures for dependent clients.
Know when Windows Server 2012 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable DNS service (AV:N) triggered by an authorized attacker (PR:L, per 'authorized'); out-of-bounds read yields DoS only, so C:N/I:N/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Exploit-DB