Windows DNS Server: Denial of service due to memory leak
Summary
A memory leak in the Windows DNS component allows an unauthenticated attacker on the network to exhaust server memory and cause a denial of service. The attack requires no user interaction and no privileges. Confidentiality and integrity are not affected, but a DNS outage can disrupt Active Directory logons and internal services.
Affected
- Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
- Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
- Windows Server 2012 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434
- Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to before 6.3.9600.23470
- Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9612
- Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9376
- Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
- Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650
Fixed in
- Windows 10 Version 1607 / Server 2016: build 10.0.14393.9612 (KB number unknown)
- Windows 10 Version 1809 / Server 2019: build 10.0.17763.9376 (KB5126651 according to Tenable)
- Windows Server 2012: build 6.2.9200.26434
- Windows Server 2012 R2: build 6.3.9600.23470
- Windows Server 2022: build 10.0.20348.5761
- Windows Server 2025: build 10.0.26100.33650 (KB5126646 according to Tenable)
- Check the MSRC advisory for the authoritative KB numbers.
Workaround
Unknown.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- EPSS 1.3%.
- No public proof of concept or researcher write-up is known.
Our recommendation
- Inventory all Windows hosts running the DNS role, including Windows 10 1607 and 1809 machines that run DNS.
- Install the October 2026 cumulative update on each affected host, prioritising internet-facing and domain controller DNS servers.
- Where patching is delayed, restrict which hosts can reach the DNS service on TCP/UDP 53 and monitor DNS server memory and responsiveness.
- Check Microsoft's lifecycle page for Windows 10 1607 and plan an upgrade if support has ended.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Denial of service – Windows DNS
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation unlikely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126646, KB5126868, KB5126835, KB5126836
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide msrc.microsoft.com
- NVD record mirror (OpenCVE) app.opencve.io
- VulDB entry vuldb.com
- Vulners CNA data (MSCVE) vulners.com
- SonicWall October 2026 Microsoft bulletin coverage www.sonicwall.com
- Vulners NVD entry vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:05.
Original description (NVD)
Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.