Act nowDisclosed

Advisory · CVE-2026-96113

Heap overflow in Windows DNS Server allows unauthenticated code execution

The Windows DNS Server service has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.

Advisory published October 13, 2026Independent summary
Vendor
Microsoft
Product
Windows DNS Server
Identifier / CWE
CVE-2026-96113
CWE-122
Action timing
Immediate
ELI5

Explain it like I’m five

The service that answers 'where is that server' can be handed a question so malformed that answering it overflows memory and runs the asker's code.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Reach the component

    An unauthenticated attacker sends crafted network traffic to a Windows system running Windows DNS Server.

  2. 02Memory flaw triggers

    The component mishandles the input and corrupts or reuses memory outside its intended bounds.

  3. 03Code runs

    The attacker gains code execution in the component's context on the target system.

What happened

Microsoft disclosed CVE-2026-96113 in its October 2026 update guide: a heap-based buffer overflow (CWE-122, with CWE-197 also listed) in DNS Server lets an unauthorized attacker execute code over a network on affected Windows Server releases and some Windows 10 releases.

Microsoft lists the affected Windows releases in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.

What to do

  1. Inventory every Windows DNS Server deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Windows DNS Server while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for DNS service crashes, malformed query floods, and name-resolution anomalies.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

A DNS server compromise poisons everything downstream of it. Patch DNS servers at the front of the queue and watch for resolution oddities.