EUVD-2026-99397
GHSA-54wv-qqqf-qfp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Windows DNS Server over network
-
DeliverySend crafted DNS query/response
-
ExploitTrigger integer underflow (CWE-191)
-
ExecutionCorrupt memory in DNS service
-
ImpactExecute arbitrary code unauthenticated
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Requires network reachability to a host running the Windows DNS Server role and processing attacker-influenced DNS traffic; per CVSS AV:N/AC:L/PR:N/UI:N this is remote, unauthenticated, low-complexity exploitation with no user interaction. The primary limiting factor is exposure of the DNS Server role itself - workstations and servers without that role installed are not affected, and environments that restrict which clients can send queries/zone traffic to the server reduce the reachable attack surface. Affected builds span Windows Server 2012 through 2025 and Windows 10/11 where the DNS Server role runs; patched builds (e.g., Server 2022 >=10.0.20348.5761, Server 2025 >=10.0.26100.33650) are not exploitable. |
| Impact | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with total compromise (C:H/I:H/A:H), scoring 9.8. CISA's SSVC framework reinforces this: Technical Impact is 'total' and Automatable is 'yes', meaning the flaw can be reliably driven at scale. The one tempering signal is SSVC Exploitation status 'none' - there is no evidence of active exploitation and the CVE is not in CISA KEV, so current risk is latent rather than realized. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified here. The signals are internally consistent: an unauthenticated memory-corruption RCE in a core network service (DNS Server) that is 'automatable' is exactly the profile that tends to be weaponized quickly once a patch is reverse-engineered, so the absence of current exploitation should not be read as low priority - patch urgency is high given a vendor fix already exists. |
| Exploit ScenarioDerived | An attacker sends specially crafted DNS traffic to a Windows DNS Server reachable over the network, triggering an integer underflow (CWE-191) in the server's packet/record processing. The resulting memory corruption is leveraged to execute arbitrary code in the context of the DNS service without authentication or user interaction. No public exploit or proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote code execution in the Windows DNS Server role is achievable by an unauthenticated, network-positioned attacker who can send crafted DNS traffic to an affected host, as described by an integer underflow (CWE-191) defect in how the service handles attacker-influenced input. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) exploitation is remote, low-complexity, requires no credentials and no user interaction, and yields total loss of confidentiality, integrity and availability on the DNS server - the practical limit being that only Windows systems actually running the DNS Server role (Windows Server 2012 through 2025, plus Windows 10/11 builds where the role is installed) are exposed. Microsoft has released vendor patches through the MSRC update guide and the EUVD advisory maps fixed builds per platform; there is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data. CISA's SSVC assessment records Exploitation: none, Automatable: yes, Technical Impact: total, which supports treating this as a genuine high-priority patching item rather than a high-score-but-low-real-risk case.
RemediationAI
Vendor-released patches are available from Microsoft per the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83869); apply the update for each platform so the DNS service build meets or exceeds the fixed level: Windows Server 2012 and 2012 R2 to 6.2.9200.26434 / 6.3.9600.23470, Windows Server 2016 and Windows 10 1607 to 10.0.14393.9612, Windows Server 2019 and Windows 10 1809 to 10.0.17763.9376, Windows Server 2022 to 10.0.20348.5761, Windows Server 2025 (and Windows 11 24H2) to 10.0.26100.33650 / 10.0.26100.9711, Windows 10 21H2/22H2 to 10.0.19044.7807 as listed, and Windows 11 23H2 / 25H2 / 26H1 / 26H2 to 10.0.22631.7652, 10.0.26200.9711, 10.0.28000.3231 and 10.0.26300.9711 respectively. Until patching completes, reduce reachability to the DNS Server role: restrict inbound UDP/TCP 53 (and DNS-over-TCP/other DNS transports) to trusted resolvers, forwarders and client subnets via host firewall or network ACLs, which closes the attack path for off-path external attackers but will break name resolution for any legitimate client left outside the allowlist and will disrupt zone transfers if secondary servers are not included; where a server exposes DNS only to an internal resolver tier, terminating external DNS at a hardened forwarder removes this surface entirely, at the cost of a less direct resolution topology. On hosts that do not need to answer queries, remove or disable the DNS Server role - this is a full mitigation with no functional downside for those systems but is destructive to any dependent zone hosting. Note that patching does not appear in CISA KEV and no public exploit code has been identified at time of analysis, so emergency out-of-band action is not mandated by exploitation evidence, but the SSVC verdict of Automatable: yes with Technical Impact: total, combined with an unauthenticated network vector, justifies treating this in the routine monthly cycle with priority over unrelated patches on internet-facing DNS infrastructure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-191 integer underflow (wrap/wraparound) inside the Windows DNS Server service - the component that answers DNS queries for a zone and is implemented in the Microsoft DNS server binaries reachable over UDP/TCP port 53 and related DNS transports. In this class of bug, a length, count or offset value derived from parsed DNS message content is reduced by an attacker-influenced quantity that exceeds it, so the unsigned result wraps to a very large value instead of going negative. That wrapped value is subsequently used for bounds calculation or buffer sizing, allowing out-of-bounds reads/writes inside the service and, in the worst case, memory corruption that an unauthorized network attacker can steer into code execution in the context of the DNS service - consistent with the vendor description 'Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.' The assigned vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the condition is exploitable without authentication, without user interaction and without a scope change, so the impact is confined to the DNS server host but is total on it. The tags accompanying the record (Authentication Bypass, Integer Overflow) are consistent with the unauthenticated network attack path and the arithmetic root cause. Affected CPE/build space spans Windows Server 2012 and 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 (1607/1809/21H2/22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) builds prior to their respective fixed build numbers; hosts without the DNS Server role installed do not expose this attack surface.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-facing DNS service reachable and exploitable without auth or interaction (AV:N/AC:L/PR:N/UI:N); memory-corruption RCE yields full code execution, so C:H/I:H/A:H and S:U.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A critical remote code execution flaw in the Windows DNS Server role affects organizations running that role on Windows Server 2012-2025 or supported Windows 10/11 builds. An unauthenticated network attacker who can reach an affected server could fully compromise DNS confidentiality, integrity, and availability, potentially disrupting business services and enabling broader network intrusion. Leadership should treat this as a high-priority patching and exposure-reduction matter; no public exploit identified at time of analysis, and patch available per vendor advisory.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB