Windows DNS Server: Remote code execution via heap-based buffer overflow
Summary
A heap-based buffer overflow in the Windows DNS Server role allows an unauthenticated remote attacker to execute code over the network. No user interaction is required, but the attack complexity is high. NVD analysis was still pending at publication.
Affected
- Windows Server 2022: 10.0.20348.0 before 10.0.20348.5870
- Windows Server 2025 and Server Core installation: 10.0.26100.0 before 10.0.26100.33822
- Other editions: Unknown.
Fixed in
- Windows Server 2022: build 10.0.20348.5870 or later
- Windows Server 2025 (including Server Core): build 10.0.26100.33822 or later
- Install the November 2026 cumulative update. KB number: see the MSRC page.
Workaround
Unknown. No workaround is listed in the sources reviewed.
- Until patched, restrict access to DNS (port 53) to intended clients and internal networks.
Exploitation
- No known exploitation in the sources reviewed. Strix lists CISA KEV: No.
- No public proof of concept found.
- CNA CVSS vector includes E:U (exploit code maturity unproven).
Our recommendation
- Identify all Windows Servers running the DNS role, including domain controllers, and their builds.
- Patch Server 2022 and Server 2025 with the November 2026 update, starting with internet-facing and domain controller DNS.
- Limit DNS access to required clients and networks and confirm that no DNS server is exposed to the internet.
- Check the MSRC advisory for KB numbers, other editions and any updated exploitability assessment.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE.org record CVE-2026-81384 www.cve.org
- Microsoft Security Update Guide msrc.microsoft.com
- Strix CVE tracker www.strix.ai
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- NT Compatible Patch Tuesday November 2026 www.ntcompatible.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:34.
Original description (NVD)
Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.