Microsoft Windows DNS Server: Remote code execution in DNS Server

Summary

A untrusted pointer dereference in the DNS Server role of Windows allows an unauthenticated attacker to execute code remotely over the network. The CVSS base score is 8.8 and the CNA rates the impact as total. Per the research notes, user interaction is required according to the CVSS vector, but this should not be relied on to rule out risk.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807 (mirror data shows a different upper bound; verify on MSRC)
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to before 6.3.9600.23470
• Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9612
• Windows Server 2019: 10.0.17763.0 to before 10.0.17763.9376

Fixed in

• Windows 10 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 1809 and Windows Server 2019: 10.0.17763.9376
• Windows 10 21H2 and 22H2: 10.0.19044.7807 and 10.0.19045.7807 (verify 22H2 on MSRC)
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2, 25H2 and 26H2: 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows Server 2012 R2: 6.3.9600.23470 (per CNA data; not confirmed on MSRC)
• Install the Microsoft security update for CVE-2026-88112 as listed on the MSRC Security Update Guide.

Workaround

Unknown. The vendor advisory directs customers to apply the security update. No vendor-documented workaround was found. Check the Mitigations section of the MSRC page for any DNS-specific mitigation.

Exploitation

• Microsoft rates exploitability as Unproven (E:U), meaning no exploit code is known.
• SSVC data reports exploitation: none and automatable: no.
• EPSS is low at about 0.007.
• No public proof of concept was found.
• CISA KEV status was not confirmed.

Our recommendation

• Patch all Windows DNS servers with the fixed builds for their version, starting with Windows 10 1607 and Windows Server 2016 and older systems.
• Check the Microsoft lifecycle page for Windows 10 1607 (LTSB 2016). If the system is out of support, plan an upgrade, because no patch may be available.
• Prioritise DNS servers that are reachable from the internet or from untrusted networks.
• Do not expose internal DNS or recursive resolvers to the internet, and restrict which hosts can send queries to DNS servers.
• Inventory all Windows DNS servers, including domain controllers, and verify their build numbers.
• Monitor DNS and domain controller logs for unusual activity and check the CISA KEV catalog for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88112 msrc.microsoft.com
• OpenCVE: CVE-2026-88112 app.opencve.io
• Vulners (CIRCL): CVE-2026-88112 vulners.com
• Strix: CVE-2026-88112 (third-party affected versions) www.strix.ai
• OffSeq: CVE-2026-88112 (third-party affected ranges) radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:12.