Windows DNS Server: Remote code execution via untrusted pointer dereference

Summary

A flaw in the Windows Domain Name Service component of Windows DNS Server allows an unauthenticated attacker to execute code remotely over the network. The CVSS vector requires no privileges but also user interaction (UI:R). Successful exploitation could give the attacker high confidentiality, integrity and availability impact on the affected server. Exposure is highest for DNS servers reachable from the internet, a DMZ or untrusted network segments.

Affected

• Windows 10 Version 1607 (below 10.0.14393.9612)
• Windows 10 Version 1809 (below 10.0.17763.9376)
• Windows 10 Version 21H2 (below 10.0.19044.7807)
• Windows 10 Version 22H2 (version listed in CNA record, see note on fixed build)
• Windows 11 Version 23H2 (below 10.0.22631.7652)
• Windows 11 Version 24H2 (below 10.0.26100.9711)
• Windows 11 Version 25H2 (below 10.0.26200.9711)
• Windows 11 Version 26H1 (below 10.0.28000.3231)
• Windows 11 Version 26H2 (below 10.0.26300.9711)
• Windows Server 2016 and Server Core installation (below 10.0.14393.9612)
• Windows Server 2019 and Server Core installation (below 10.0.17763.9376)
• Windows Server 2022 (below 10.0.20348.5761)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612 or later
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9376 or later
• Windows 10 Version 21H2: 10.0.19044.7807 or later
• Windows 10 Version 22H2: Unknown. The CNA record lists 10.0.19044.7807, which is the 21H2 build, so this is likely an error. Confirm on MSRC.
• Windows 11 Version 23H2: 10.0.22631.7652 or later
• Windows 11 Version 24H2, 25H2 and 26H2: 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711 or later
• Windows 11 Version 26H1: 10.0.28000.3231 or later
• Windows Server 2022: 10.0.20348.5761 or later
• Exact KB numbers: check the MSRC Security Update Guide.

Workaround

• No vendor-issued mitigation beyond patching was found.
• If patching is delayed, restrict network access to the DNS server with firewall rules or place it in a demilitarized zone.

Exploitation

• No exploitation in the wild known.
• No public proof of concept found in the sources reviewed; this does not prove none exists.
• CISA SSVC data: exploitation none, automatable no.
• EPSS below 1 percent (very low).
• Microsoft rates the vulnerability Important.

Our recommendation

• Identify all systems running the DNS Server role, including any Windows 10 or Server 2016 hosts, and confirm their support status with Microsoft.
• Patch DNS servers first, especially those reachable from the internet, a DMZ or untrusted networks.
• Until patched, restrict access to the DNS service to required clients only.
• Monitor DNS servers for unexpected crashes, restarts or access violations in dns.exe.
• Verify the fixed build for Windows 10 Version 22H2 on MSRC.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft MSRC Security Update Guide: CVE-2026-88116 msrc.microsoft.com
• OpenCVE: CVE-2026-88116 app.opencve.io
• Vulners CVE list: CVE-2026-88116 vulners.com
• Strix: CVE-2026-88116 (Server 2016 build data) www.strix.ai
• Microsoft customer-risk cohort document 2026 CVEs cdn-dynmedia-1.microsoft.com
• SentinelOne vulnerability database: CVE-2026-88116 www.sentinelone.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:14.