Windows DNS Server: Use-after-free leads to remote code execution
Summary
A use-after-free vulnerability in the DNS Server component of Windows Server 2025 allows an unauthorized attacker to execute code remotely over the network. The attack complexity is rated high, and no privileges or user interaction are required. Domain controllers and internet-facing DNS servers carry the highest risk.
Affected
- Windows Server 2025 (including Server Core installation), x64, builds 10.0.26100.0 before 10.0.26100.33822
- Other Windows Server versions: Unknown. Check the MSRC advisory.
Fixed in
- Build 10.0.26100.33822 or later for Windows Server 2025 (inferred from the CVE record, verify on the MSRC advisory)
Workaround
- Unknown. No vendor workaround found.
- Interim measures that reduce exposure but do not fix the flaw: restrict which hosts can reach port 53 on DNS servers, and monitor dns.exe for unusual child processes or outbound connections.
Exploitation
- No evidence of exploitation in the wild found.
- Exploit code maturity is rated Unproven at publication.
- Not listed in CISA KEV at the time of research.
- No public proof of concept found.
- NVD analysis is still pending.
Our recommendation
- Inventory all Windows Server 2025 hosts with the DNS Server role, including Server Core.
- Verify the build is 10.0.26100.33822 or later.
- Patch internet-facing and domain controller DNS servers first.
- Restrict access to port 53 to required hosts as an interim measure.
- Monitor NVD, CISA KEV and MSRC for changes to the exploitation status.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE.org Record CVE-2026-96092 www.cve.org
- Microsoft Security Update Guide CVE-2026-96092 msrc.microsoft.com
- Zero Day Initiative: November 2026 Security Update Review www.zerodayinitiative.com
- Strix: CVE-2026-96092 www.strix.ai
- NewsBeep: November 2026 Patch Tuesday (third-party) www.newsbeep.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:32.
Original description (NVD)
Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.