Windows DNS Server: Information disclosure through integer overflow

Summary

A integer overflow or wraparound in the Windows DNS Server component allows an unauthenticated attacker on the network to disclose information. No privileges or user interaction are required, and the attack complexity is low. The exact data that can be disclosed is not described in the available sources.

Affected

• Windows Server 2016 and 2016 Server Core: builds from 10.0.14393.0 before 10.0.14393.9688
• Windows Server 2019 and 2019 Server Core: builds from 10.0.17763.0 before 10.0.17763.9487
• Windows Server 2022: builds from 10.0.20348.0 before 10.0.20348.5870 (unverified, taken from a third-party aggregator)
• Windows Server 2025 and 2025 Server Core: builds from 10.0.26100.0 before 10.0.26100.33822 (unverified, taken from a third-party aggregator)
• Windows 10 and Windows Server 2012/2012 R2: Unknown.

Fixed in

• Builds at or above the listed values in the CNA record (2016: 10.0.14393.9688, 2019: 10.0.17763.9487). The 2022 and 2025 values must be verified against the MSRC advisory.
• KB article numbers: Unknown.

Workaround

• No vendor workaround found.
• General hardening (not from a vendor source): remove the DNS Server role where it is not needed and restrict which networks can reach the DNS service.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No public proof of concept or exploitation in the wild found. The search was limited, so this is not proof of absence.

Our recommendation

• Check whether the Windows DNS Server role is installed on any Windows Server 2016, 2019, 2022 or 2025 host, especially on domain controllers.
• Verify the affected builds against the MSRC advisory and install the November 2026 security updates.
• Apply the fix for CVE-2026-81384 (remote code execution in the DNS Server) in the same maintenance window.
• Restrict DNS access to required networks and do not expose internal DNS servers to the internet.
• Monitor for public proof-of-concept code or exploitation reports and re-check the NVD entry once analysis is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105579 msrc.microsoft.com
• CVE Record CVE-2026-105579 (CVE.org) www.cve.org
• Strix: CVE-2026-105579 (unverified version data) www.strix.ai
• Microsoft Security Update Guide: CVE-2026-81384 (related DNS Server RCE) msrc.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:08.