Windows Server DNS: Information disclosure through out-of-bounds read

Summary

Windows DNS Server on Windows Server 2016, 2019, 2022 and 2025, including Server Core installations, contains an out-of-bounds read. An attacker who already holds high privileges on the network can read sensitive server memory and disclose information, but the CVSS vector shows no integrity or availability impact. The main risk comes from a compromised administrator or domain-level account or a malicious insider, especially on DNS servers and domain controllers.

Affected

• Windows Server 2016 and Server Core installation: builds before 10.0.14393.9688
• Windows Server 2019 and Server Core installation: builds before 10.0.17763.9487
• Windows Server 2022: builds before 10.0.20348.5870
• Windows Server 2025 and Server Core installation: builds before 10.0.26100.33822

Fixed in

• Install the November 2026 cumulative update for each affected version, which brings the build to the fixed level listed above or higher.
• The KB numbers for this CVE are not confirmed. Unknown until checked on the Microsoft Security Update Guide.

Workaround

Unknown. No workaround or mitigation was found; apply the security update.

Exploitation

• No known exploitation in the wild.
• Microsoft rates exploitation as less likely and the vulnerability as not publicly disclosed.
• CISA SSVC: exploitation none, not automatable.
• No public proof of concept found in a web search; this does not rule out that one exists.

Our recommendation

• Patch Windows Server 2016, 2019, 2022 and 2025 in the normal monthly cycle, starting with DNS servers and domain controllers.
• Verify the installed build against the fixed versions after patching.
• Limit administrative accounts and monitor their use, since the attack requires high privileges.
• Check whether DNS runs on domain controllers in your environment.
• Watch for a public proof of concept or a KEV listing, and check NVD once analysis is complete.
• Patch other Windows DNS hosts together with this one, including for the separate October 2026 DNS flaw CVE-2026-70119.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119970 msrc.microsoft.com
• CVE Record CVE-2026-119970 (CNA: Microsoft) www.cve.org
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• Senserva KB5131085 (third-party) senserva.com
• Strix CVE-2026-119970 (third-party) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:38.