Microsoft Windows DNS Server: Remote code execution via invalid pointer

Summary

A flaw (CWE-763, release of invalid pointer or reference) in the Windows DNS Server component allows code execution on the server over the network. According to Microsoft, an authenticated attacker with low-level access to an affected server can send a specially crafted request to execute code, and no user interaction is required. The CVSS base score is 8.8 (High). Exposure to the internet is not indicated; the threat is mainly from insiders, compromised low-privilege accounts or attackers already inside the network.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612) - status to be verified on MSRC
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 and 2012 R2 (incl. Server Core; 6.2.9200.0 to before 6.2.9200.26434 and 6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Fixed in

• Windows 10 1607 / Server 2016: build 10.0.14393.9612 (KB number unknown)
• Windows 10 1809 / Server 2019: KB5126651 (October 2026 security update, according to Tenable)
• Windows Server 2025: KB5126646 (October 2026 security update, according to Tenable)
• Other versions: see the fixed build numbers in the affected list; full KB table on MSRC

Unknown: KB number for Windows 10 1607 and Server 2016.

Workaround

Unknown. No vendor-published workaround was found. Check the MSRC page for mitigation details.

Exploitation

• Microsoft: publicly disclosed: no; exploited: no; exploitability assessment: Exploitation Less Likely (status at time of research)
• CISA SSVC: exploitation none, automatable no, technical impact total
• No public proof of concept or exploitation reports found. CISA KEV status not checked.

Our recommendation

• Verify on MSRC whether Windows 10 1607 is affected and obtain the correct KB number.
• Install the October 2026 security updates on all Windows Server systems with the DNS role, especially domain controllers, and on affected Windows clients.
• Start with internal DNS servers that are reachable by many low-privilege users.
• Check whether any DNS server answers on public addresses and restrict access.
• Monitor DNS servers and domain controllers for unusual requests or crashes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-83889 msrc.microsoft.com
• NVD/Vulners: CVE-2026-83889 vulners.com
• Strix: CVE-2026-83889 www.strix.ai
• OpenCVE: CVE-2026-83889 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:26.