Microsoft Windows DNS Server: Remote code execution via integer underflow

Summary

Microsoft Windows DNS Server contains an integer underflow (CWE-191) that allows an unauthenticated attacker to execute code remotely over the network. No user interaction is required, and Microsoft rates the CVSS 3.1 base score at 9.8 (Critical), although Microsoft's own severity is Important. Systems with the DNS Server role that are reachable from untrusted networks carry the highest risk.

Affected

• Windows 10 Version 1607 (build 10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (build 10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (build 10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (build 10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (build 10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (build 10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (build 10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (build 10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (build 10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012 incl. Server Core (build 6.2.9200.0 to < 6.2.9200.26434)
• Windows Server 2012 R2 incl. Server Core (build 6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 (build 10.0.14393.0 to < 10.0.14393.9612)

Fixed in

• Install the Microsoft security update for October 2026 (released 13 October 2026).
• Fixed builds per the CVE record: 10.0.14393.9612 (Windows 10 1607, Server 2016), 10.0.17763.9376 (1809), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 6.3.9600.23470 (Server 2012 R2), 6.2.9200.26434 (Server 2012).
• Verify the exact builds in the MSRC affected-product table before deployment. No KB number for Windows 10 1607 or Server 2016 was confirmed.

Workaround

Unknown. No vendor-documented workaround was found.

• Interim measures, not vendor-sourced: restrict DNS (TCP/UDP 53) to required sources, make sure internal DNS servers are not reachable from the internet, and monitor for DNS service crashes or unusual traffic.

Exploitation

• CISA SSVC data lists exploitation as "none" and automatable as "yes".
• The CVE is not listed in CISA's KEV catalogue according to OpenCVE.
• No public proof-of-concept was found in the research. This does not prove that none exists.
• A VulDB estimate of about USD 25k–100k for an exploit is a market estimate, not evidence of exploitation.

Our recommendation

• Patch all Windows systems with the DNS Server role first, prioritising internet-facing and segment-crossing servers.
• Windows 10 1607 LTSB reached end of support on 13 October 2026. Confirm ESU eligibility now; without ESU, replace or isolate the system.
• Check your estate for the DNS Server role, including on Windows 10 clients, which needs verification.
• Restrict DNS access, block exposure to the internet and to guest or IoT segments, and monitor DNS logs.
• Re-check KEV and the MSRC exploited flag in the coming days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83869 msrc.microsoft.com
• Microsoft Security Update Guide (en-US): CVE-2026-83869 msrc.microsoft.com
• Vicarius: Microsoft October 2026 Patch Tuesday www.vicarius.io
• Vulners NVD entry: CVE-2026-83869 vulners.com
• OpenCVE: CVE-2026-83869 app.opencve.io
• VulDB: CVE-2026-83869 vuldb.com
• 4sysops: Windows 10 Enterprise LTSB 2016 end of support and ESU 4sysops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:33.