EUVD-2026-99180
GHSA-pwjq-hq83-6h95
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Windows DNS over network
-
DeliverySend repeated crafted DNS queries
-
ExploitTrigger unfreed memory allocations (CWE-401)
-
ExecutionAccumulate leaked memory over time
-
ImpactExhaust server memory, deny DNS service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Requires network reachability to the Windows DNS service on an affected build (Windows 10 1607/1809, Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core, below the patched revisions listed in the EUVD data). No authentication, privileges, or user interaction are needed (PR:N/UI:N), and default DNS-server deployments that answer queries are exposed. The main limiting factor is that this is a gradual memory-leak exhaustion rather than an instant crash - impact depends on sustained/repeated requests and available server memory, and a server not exposing the DNS role to attacker-reachable networks is not affected. |
| Impact | This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) describes a remote, unauthenticated, low-complexity attack with no user interaction, affecting availability only - consistent with CWE-401 (memory leak) causing denial of service in the Windows DNS service. Signals are mixed: CISA's SSVC framework rates Exploitation as 'none' (no observed exploitation) and Technical Impact as 'partial', which is slightly more conservative than the CVSS A:H rating, but flags Automatable as 'yes' - meaning the condition can be triggered reliably and at scale through repeated network requests. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied, so exploitation probability cannot be quantified from the input. The SSVC 'partial' technical impact versus CVSS 'A:H' is a notable tension: memory-leak DoS is typically gradual (resource exhaustion over many requests) rather than an instant crash, which supports treating this as a reliability/availability risk to DNS infrastructure rather than a critical system-compromise flaw. Because DNS is foundational infrastructure, availability loss has outsized operational blast radius even without confidentiality or integrity impact. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a stream of crafted DNS queries to an exposed Windows DNS server; each request leaks memory that is never released, and over time the accumulating allocation exhausts available memory and degrades or crashes the DNS service. No public exploit code has been identified, but SSVC marks the issue as automatable, so a trivial request-flooding script could reliably reproduce the exhaustion. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A memory-leak flaw (CWE-401) in the Microsoft Windows DNS Server service lets an unauthenticated, remote attacker gradually exhaust server memory by sending repeated DNS queries, ultimately degrading or denying DNS resolution on affected hosts. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H), no credentials or user interaction are required, and any default DNS-server deployment reachable on the network is exposed; however, this is a slow resource-exhaustion condition rather than an instantaneous crash, so the practical impact scales with sustained traffic and available memory. An independent assessment rates this as a genuine but second-tier priority: SSVC indicates no known exploitation, no publicly available exploit code has been identified at time of analysis, and a vendor patch is available, making timely patching the decisive control.
RemediationAI
Patch available per vendor advisory: Microsoft has released fixes through the Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70155, and remediation consists of updating each affected host to at or above the corresponding fixed build - 10.0.14393.9612 for Windows 10 1607 / Server 2016, 10.0.17763.9376 for Windows 10 1809 / Server 2019, 6.2.9200.26434 for Windows Server 2012 (including Server Core), 6.3.9600.23470 for Windows Server 2012 R2 (including Server Core), 10.0.20348.5761 for Windows Server 2022, and 10.0.26100.33650 for Windows Server 2025 (including Server Core). Because authentication is not required (PR:N/UI:N) and the exploit is fully automatable per SSVC, an unpatched Internet-exposed DNS server should be treated as reachable by the attack before any other compensating measure is applied; where patching cannot be immediate, restrict UDP/TCP 53 to known trusted resolvers and clients using host- or network-firewall rules, which stops the leak from being driven but breaks open/unrestricted resolver deployments. If the DNS role is not needed on a host, remove it entirely - that eliminates exposure outright. DNS response-rate limiting and query-volume thresholds can slow memory growth but add CPU overhead and may drop legitimate bursty query traffic, and periodically restarting the DNS Server service reclaims leaked memory yet causes a short resolution outage and is only a stopgap, not a fix. Enable memory-usage monitoring and alerting on dns.exe on unpatched resolvers so exhaustion is detected before full denial of service, and note that per SSVC there is no confirmed exploitation and no public exploit code identified at time of analysis, so these compensating controls are precautionary rather than a response to active attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is rooted in CWE-401, Missing Release of Memory after Effective Lifetime - heap allocations performed while processing DNS requests are not freed once they are no longer needed, so memory consumption grows monotonically with query volume until the DNS service (dns.exe) is exhausted, becomes unresponsive, or is restarted by the system. Unlike a buffer overflow or use-after-free, there is no code-execution primitive: the weakness sits purely in the memory-management lifecycle of the DNS service, so confidentiality and integrity are unaffected and only availability is degraded. The affected component is the Windows DNS Server role, which normally listens on UDP/TCP port 53 for inbound queries; the EUVD data identifies impacted builds as Windows 10 Version 1607 and 1809, Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, each below a specific patched revision. The attack surface is therefore any host that actually runs the DNS Server role and answers queries from attacker-reachable networks - workstations that merely act as DNS clients, and servers that do not expose the DNS role, fall outside the exploitable configuration even if they share the affected build numbers.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, unauthenticated, low-complexity network requests to the DNS service (AV:N/AC:L/PR:N/UI:N); memory-leak DoS yields availability-only impact (A:H, C:N/I:N) with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.
Executive ViewAI
A high-severity memory-leak flaw in Microsoft Windows DNS Server could allow an unauthenticated remote attacker to gradually exhaust server memory and disrupt DNS resolution, affecting any business service that depends on name resolution. Although no public exploit identified at time of analysis, a vendor patch is available, making timely patching the decisive control. Leadership should prioritize remediation of all exposed DNS servers to prevent operational disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB