IT SBIT Services
Schneeberger
DEEN
CVE tracker

Windows Server DNS Server: Denial of service through out-of-bounds read

CVE-2026-83635High 7.5

← All vulnerabilities

Summary

An out-of-bounds read in the DNS Server role of Windows Server 2012 through 2025 allows an unauthenticated attacker on the network to cause a denial of service. Per the CVSS vector, the impact is limited to availability, with no confidentiality or integrity loss. No privileges or user interaction are required, so an internal DNS server can be targeted from the LAN or from a compromised internal host. Internet exposure is the worst case and only applies if public DNS runs on Windows Server.

Affected

  • Windows Server 2012 (including Server Core): builds before 6.2.9200.26434
  • Windows Server 2012 R2 (including Server Core): builds before 6.3.9600.23470
  • Windows Server 2016 (including Server Core): builds before 10.0.14393.9612
  • Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
  • Windows Server 2022: builds before 10.0.20348.5761
  • Windows Server 2025 (including Server Core): builds before 10.0.26100.33650
  • Build numbers are taken from third-party mirrors and must be confirmed on MSRC.

Fixed in

  • Install the Microsoft security update for your operating system as listed on MSRC (release date October 13, 2026).
  • Confirm the fixed build on MSRC before rollout.
  • Windows Server 2012 and 2012 R2 are out of standard support; patches are normally only available under Extended Security Updates (ESU). Check your ESU status.

Workaround

Unknown. No vendor workaround was found. The only listed remediation is the patch.

  • Interim measure (not from a vendor source): limit which hosts can reach DNS on UDP/TCP 53 and do not expose internal DNS servers to the internet.

Exploitation

  • No evidence of exploitation in the wild was found in the research.
  • CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
  • No public proof of concept was found.
  • EPSS is about 1.3%, so the predicted exploitation probability is low.
  • CISA KEV status was not checked.

Our recommendation

  • Inventory all Windows DNS servers, especially domain controllers and systems running Windows Server 2012 or 2012 R2.
  • Confirm the fixed build on MSRC and patch in the next maintenance window; patch sooner if the system is exposed or still on 2012/2012 R2.
  • Restrict access to DNS on TCP/UDP 53 to required hosts only.
  • Monitor DNS service restarts and crashes after patching.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Denial of service – Role: DNS Server
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5126651, KB5126655, KB5126646, KB5126868, KB5126835, KB5126836

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:53.

Original description (NVD)

Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed