EUVD-2026-100404
GHSA-q3mj-m279-8c45
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach DNS service on port 53
-
DeliverySend crafted malicious DNS message
-
ExploitOverflow heap buffer in DNS parser
-
ExecutionExecute arbitrary code on server
-
ImpactPivot across internal network
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond the DNS Server role being installed and reachable: the host must be running the Windows DNS Server service (a standard role on Active Directory domain controllers and standalone DNS servers) and must accept DNS messages from the attacker's network position. Per AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, low-complexity, and requires no user interaction against default configurations once the role is enabled. The primary limiting factors are network reachability of port 53 (internet-exposed or forwarding/recursive resolvers are highest risk; purely internal-only resolvers reduce the attacker population to those with network access) and whether the affected build is below the patched version listed in EUVD. |
| Impact | This is a genuine top-tier priority, not a high-CVSS-but-low-risk artifact. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) describes unauthenticated, low-complexity, network-reachable remote code execution with full C:H/I:H/A:H impact, and the affected component - the Windows DNS Server role - is listening on UDP/TCP 53 and frequently exposed to untrusted traffic, which maximizes the realism of the network vector. The signals are internally consistent: Microsoft (secure@microsoft.com) both reported and patched it, CWE-122 (heap-based buffer overflow) aligns with the 'execute code over a network' description, and the broad EUVD affected-version list spanning Windows Server 2012 through 2025 confirms a wide, long-lived exposure. The one tempering factor is that no exploitation-probability or active-exploitation evidence is present in the input: there is no EPSS score, no CISA KEV listing, and no public POC referenced, so current real-world exploitation is unproven. Historically, unauthenticated DNS Server RCE classes (e.g. SIGRed) attract rapid weaponization, so the absence of a POC today should be read as 'not yet public' rather than 'low likelihood.' Treat as emergency-patch class. |
| Exploit ScenarioDerived | An attacker who can reach the DNS service (an internal foothold on a corporate network, or an internet-exposed/forwarding DNS server) sends a maliciously crafted DNS message that overflows a heap buffer during parsing. With AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed, and successful exploitation yields code execution in the DNS Server process context, typically highly privileged on a Windows Server. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated remote code execution affects the Windows DNS Server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809, driven by a heap-based buffer overflow (CWE-122) that a network attacker can trigger by sending crafted DNS messages to an affected host. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation is remote, unauthenticated, low-complexity and requires no user interaction once the DNS Server service is installed and reachable - making internet-exposed, forwarding or recursive resolvers the highest-risk deployments, while purely internal-only resolvers simply narrow the attacker population to those with network access. This is a genuine top-tier priority rather than a high-score-but-low-risk artifact, though no public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); Microsoft has released fixes through the MSRC update guide, so the primary exposure is unpatched hosts rather than a lack of remediation.
RemediationAI
Vendor-released patches are available per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96113; apply the current cumulative update for each affected branch so that hosts reach or exceed the first fixed builds indicated by the EUVD ranges - 10.0.20348.5761 for Windows Server 2022, 10.0.17763.9376 for Windows Server 2019 and Windows 10 1809, 10.0.14393.9612 for Windows Server 2016 and Windows 10 1607, 10.0.26100.33650 for Windows Server 2025, 6.3.9600.23470 for Windows Server 2012 R2, and 6.2.9200.26434 for Windows Server 2012 - and prioritize domain controllers, internet-facing recursive or forwarding resolvers, and any host with port 53 reachable from untrusted networks. Where immediate patching is not possible, reduce exposure by blocking inbound TCP and UDP port 53 from the internet and from untrusted internal segments at the perimeter and host firewall, with the trade-off that legitimate external or cross-segment resolution will break for clients that depend on those paths; disable recursion or restrict it to authorized client subnets so the server no longer accepts arbitrary queries (side effect: clients outside the allowed set lose resolution service and must be repointed to another resolver); disable DNS dynamic updates and zone transfers to untrusted sources where they are not required (side effect: dynamic registration and secondary zone replication must be handled manually); and isolate the DNS role from general-purpose workloads so a compromise cannot pivot directly into other services. Monitor for service crashes or unexpected w3wp/DNS process restarts, which are the most likely early indicator of heap corruption attempts, and treat any such event on an exposed resolver as a potential exploitation attempt given the unauthenticated, network-reachable nature of the flaw. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so these compensating controls are contingency measures while patching is scheduled, not evidence of ongoing campaigns.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a heap-based buffer overflow (CWE-122) in the DNS Server service shipped as a standard Windows Server role and present by default on Active Directory domain controllers and standalone DNS servers. CWE-122 describes memory allocated on the heap being written past its bounds, typically because an attacker-controlled length or count field from a parsed packet is not validated against the size of the destination buffer; in a DNS context this means malformed or oversized fields in received query or response messages can corrupt adjacent heap metadata and, under the right conditions, be leveraged for code execution in the context of the DNS service. Because the service listens on the well-known DNS port 53 over UDP and TCP, the attack surface is the protocol parser itself rather than any web or authentication layer, and the assessed vector's PR:N and UI:N values confirm that no credentials or victim interaction are needed beyond the service being enabled and reachable. The affected build ranges supplied by EUVD span multiple Windows servicing branches - Windows Server 2022 (10.0.20348.x), Windows Server 2025 (10.0.26100.x), Windows Server 2019 and Windows 10 1809 (10.0.17763.x), Windows Server 2016 and Windows 10 1607 (10.0.14393.x), and the legacy Windows Server 2012/2012 R2 lines (6.2.9200.x and 6.3.9600.x) - which reflects that the same DNS parser code is shared and serviced independently per branch. The reporting source is Microsoft's own security response contact (secure@microsoft.com) and the associated references point to the Microsoft Security Response Center update guide entry, tying the issue to a vendor-coordinated fix rather than a third-party disclosure.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
DNS Server parses attacker-supplied network messages with no auth or interaction (AV:N/AC:L/PR:N/UI:N); heap-overflow RCE in the service process yields full C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A critical, unauthenticated remote code execution vulnerability in the Windows DNS Server role affects a broad set of Windows Server and Windows 10 deployments, allowing a network attacker to compromise DNS infrastructure without credentials or user interaction. Because DNS is foundational to authentication, application access, and internal routing, successful exploitation could disrupt operations, enable lateral movement, and expose sensitive systems, with internet-facing or reachable resolvers representing the highest organizational risk. Patch available per vendor advisory; no public exploit identified at time of analysis, but leadership should treat remediation as an urgent priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB