Microsoft Windows Server DNS: Information disclosure via out-of-bounds read

Summary

The DNS Server role of Microsoft Windows Server 2016, 2019, 2022 and 2025 contains an out-of-bounds read that can expose memory. A network-based attacker without privileges or user interaction can read memory from the DNS Server service, but cannot modify data or stop the service. Microsoft states that exploitation also requires DNS packet debug logging to be enabled, which is disabled by default, and rates attack complexity as high.

Affected

• Windows Server 2016 and Server Core installation: 10.0.14393.0 before 10.0.14393.9688
• Windows Server 2019 and Server Core installation: 10.0.17763.0 before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 before 10.0.20348.5870
• Windows Server 2025 and Server Core installation: 10.0.26100.0 before 10.0.26100.33822 (taken from a third-party aggregator, not yet verified in the MSRC advisory)
• Client Windows editions: Unknown.

Fixed in

• Builds 10.0.14393.9688, 10.0.17763.9487, 10.0.20348.5870 or later, delivered with the November 2026 security update.
• Windows Server 2025: fixed build to be confirmed in the MSRC advisory.
• Knowledge base article numbers: see the MSRC advisory.

Workaround

• Microsoft states that exploitation requires DNS packet debug logging. Check whether it is enabled and disable it if it is not needed. This is an inference and should be confirmed with Microsoft guidance.
• Restrict network access to DNS servers to the clients that need them.

Exploitation

• Microsoft rates exploit code maturity as unproven (E:U).
• No public exploit, in-the-wild exploitation or CISA KEV entry was found during research.
• CISA SSVC: exploitation none, not automatable.
• Rapid7 lists the CVE as Exploitation Less Likely.

Our recommendation

• Install the November 2026 security update on all Windows Server DNS servers in the normal patch cycle.
• Check now whether DNS packet debug logging is enabled and disable it where it is not needed.
• Prioritise DNS servers reachable from the internet or with debug logging enabled.
• Identify all servers with the DNS role, including domain controllers.
• Monitor CISA KEV and NVD for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-108425 msrc.microsoft.com
• CVE Record: CVE-2026-108425 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Strix: CVE-2026-108425 (third-party, unverified affected versions) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:31.