EUVD-2026-100159
GHSA-24wv-87rv-c68f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to network with low privileges
-
ExploitSend crafted DNS query
-
ExecutionTrigger out-of-bounds read in DNS Server
-
ImpactCrash service causing denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an affected Windows DNS Server role running on an unpatched Windows Server release (2012 through 2025, including Server Core, below the fixed builds listed in EUVD-2026-100159) that is reachable over the network. Per the CVSS vector (PR:L), the attacker must hold valid low-level credentials/authorization to the target - this is explicitly an 'authorized attacker,' not anonymous - and no user interaction is needed (UI:N). Limiting factors: the privilege requirement rules out fully unauthenticated exploitation, the impact is confined to availability (service crash/DoS) with no code execution or data access, and CISA SSVC rates it non-automatable, reducing the likelihood of wormable or large-scale abuse. |
| Impact | This is a moderate-priority, authenticated denial-of-service issue rather than a critical remote-code-execution threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) shows network reach with low complexity but requires privileges (PR:L), and the only impact is availability (A:H) - no confidentiality or integrity loss, consistent with the description's 'deny service.' CISA's SSVC framework reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial, all pointing to Track/monitor rather than act now. There is no KEV listing and no public exploit identified at time of analysis, so this is a high-CVSS-but-low-real-risk issue in practice: the DoS requires an attacker who already holds valid (if low) credentials, and it cannot be mass-automated. Note the input Tags ('Buffer Overflow, Information Disclosure') conflict with the actual impact - the CVSS vector sets C:N/I:N and the description states only denial of service, so no information disclosure actually occurs; treat the 'Information Disclosure' label as inaccurate metadata, not a confirmed data-exposure risk. |
| Exploit ScenarioDerived | An attacker with low-privileged, authenticated network access to an affected Windows DNS Server sends a specially crafted query that triggers an out-of-bounds read (CWE-125) in the DNS service, crashing it and denying name resolution to dependent clients. No public exploit code has been identified, and the attack yields no data exposure or code execution - only service disruption. Because DNS underpins Active Directory and general connectivity, an outage can cascade across the environment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in the Microsoft Windows DNS Server role allows a network-reachable attacker who holds valid low-privilege credentials to crash or destabilize the DNS service on unpatched Windows Server releases from 2012 through 2025, including Server Core installations. Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authorization on the target - this is explicitly an 'authorized attacker' scenario, not anonymous remote abuse - and the resulting impact is availability only, with no code execution, no data access, and no integrity loss. No public exploit has been identified at time of analysis and CISA's SSVC rates the issue non-automatable with nonexistent observed exploitation, making this a moderate-priority availability bug rather than a critical RCE-class threat.
RemediationAI
Patch available per vendor advisory: Microsoft's update guide for CVE-2026-88130 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88130) documents the security updates that raise each affected release above the fixed build thresholds listed in EUVD-2026-100159 - 6.2.9200.26434 for Windows Server 2012, 6.3.9600.23470 for Windows Server 2012 R2, 10.0.14393.9612 for Windows Server 2016, 10.0.17763.9376 for Windows Server 2019, 10.0.20348.5761 for Windows Server 2022, and 10.0.26100.33650 for Windows Server 2025, including their Server Core equivalents; apply the appropriate cumulative update and restart the DNS Server service to load the patched binaries. If immediate patching is not possible, restrict network access to the DNS service: block inbound UDP/TCP 53 from untrusted or broadly scoped source ranges at the perimeter and host firewall so that only known resolvers, forwarders, and management subnets can query the server - the trade-off is that genuinely public or partner-facing resolution will break until the rule set is refined. Because exploitation requires PR:L authorization, reducing the number of accounts and services that can legitimately reach the DNS listener (segregating the DNS Server role onto dedicated hosts, removing unnecessary delegation and dynamic-update permissions, and enforcing least privilege on DNS management accounts) directly shrinks the attack surface, at the cost of additional operational overhead. Monitor DNS Server and system event logs for repeated service crashes, unexpected restarts, or malformed-query bursts, and treat unexplained DNS service terminations as potential exploitation attempts worth investigating, keeping in mind that these are detective rather than preventive controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 11 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Windows DNS Server role shipped with Windows Server (a core Windows network service, not the DNS client resolver). The root cause is classified as CWE-125, an out-of-bounds read: while processing DNS requests, the service reads past the bounds of an allocated buffer, which in the assessed scenario causes a fault that terminates or destabilizes the service rather than permitting code execution. Vendor tagging additionally lists 'Buffer Overflow' and 'Information Disclosure', both of which are consistent with OOB-read bug classes - memory-safety faults in parsers often leak adjacent memory - but the assessed vector sets C:N (no confidentiality impact), meaning the read is not being credited with meaningful data disclosure here; the practical outcome is the A:H availability hit. The vulnerability is scoped as S:U (unchanged) and requires PR:L, indicating the attacker must already hold some valid credentials or authorization on the target, and UI:N means no victim interaction is needed once the crafted request is sent over the network. Because it is protocol-facing (AV:N) and the underlying parsing logic is deterministic, but SSVC rates it non-automatable, mass-scanning abuse is not expected.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable DNS service (AV:N/AC:L) but 'authorized attacker' means PR:L; impact is denial of service only, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB