Windows DNS Server: Information disclosure via out-of-bounds read

Summary

An out-of-bounds read in the DNS Server role of several Windows client and server versions allows an authorized attacker to disclose information over the network. The attacker needs a valid low-privilege account, requires no user interaction, and the impact is limited to confidentiality. The main risk is a compromised user account or an insider, and the risk rises if the DNS server is reachable from untrusted networks.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (below 10.0.14393.9612)
• Windows 10 Version 1809 and Windows Server 2019 (below 10.0.17763.9376)
• Windows 10 Version 21H2 (below 10.0.19044.7807) and Version 22H2 (below 10.0.19045.7807)
• Windows 11 Version 23H2 (below 10.0.22631.7652), 24H2 (below 10.0.26100.9711), 25H2 (below 10.0.26200.9711), 26H1 (below 10.0.28000.3231) and 26H2 (below 10.0.26300.9711)
• Windows Server 2012 (below 6.2.9200.26434) and Windows Server 2012 R2 (below 6.3.9600.23470), including Server Core installations
• Windows Server 2022 and Windows Server 2025 (affected builds per vendor data, exact range to be verified on MSRC)

Fixed in

• Windows 10 1607 / Server 2016: 10.0.14393.9612
• Windows 10 1809 / Server 2019: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807; Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652; 24H2: 10.0.26100.9711; 25H2: 10.0.26200.9711; 26H1: 10.0.28000.3231; 26H2: 10.0.26300.9711
• Windows Server 2012: 6.2.9200.26434; Windows Server 2012 R2: 6.3.9600.23470
• Windows Server 2022: 10.0.20348.5761; Windows Server 2025: 10.0.26100.33650
• Security update released October 13, 2026. The KB number for Windows 10 1607 / Server 2016 is unknown; check the MSRC page.

Workaround

Unknown.

• No vendor workaround identified. Patching is the primary fix.
• Until patched, limit which hosts can reach the DNS service, especially from guest, DMZ or untrusted networks (general practice).

Exploitation

• No exploitation in the wild found. The CVE was not found in the CISA KEV catalog, but this should be verified.
• Microsoft rates exploit code maturity as Unproven (E:U) and the remediation level as Official Fix (RL:O).
• CISA SSVC: exploitation none, not automatable, partial technical impact.
• No public proof of concept found.
• EPSS score is about 0.011 (low).

Our recommendation

• Apply the October 2026 Windows security update on all listed systems, including Windows 10 1607 and Server 2016 after checking the KB number on MSRC.
• Verify the affected build ranges on the MSRC Security Update Guide before rollout, as some sources differ.
• Check whether Windows 10 1607 and Server 2016 are still in support and plan an upgrade if they are not.
• Confirm that DNS servers are not reachable from the internet, DMZ or untrusted Wi-Fi, and restrict access to internal hosts.
• Review accounts with DNS access and monitor for unusual DNS queries or access to DNS server data.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-108127 msrc.microsoft.com
• NVD record via Vulners vulners.com
• Strix CVE record CVE-2026-108127 www.strix.ai
• ThreatInt CVE record CVE-2026-108127 cve.threatint.com
• EUVD record via Vulners (KB articles) vulners.com
• Vulners PT-2026-112006 (EPSS) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 5 Nov 2026, 11:28.