Microsoft Windows DNS Server: Remote code execution via heap-based buffer overflow
Summary
A heap-based buffer overflow in the Windows DNS Server role allows an unauthenticated attacker to execute code remotely over the network. No user interaction is required, and the CVSS base score is 9.8 (critical). Servers with the DNS Server role reachable from untrusted networks, including domain controllers that run DNS, are at the highest risk.
Affected
- Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds 10.0.14393.0 to before 10.0.14393.9612
- Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds 10.0.17763.0 to before 10.0.17763.9376
- Windows Server 2012 (including Server Core): builds 6.2.9200.0 to before 6.2.9200.26434
- Windows Server 2012 R2 (including Server Core): builds 6.3.9600.0 to before 6.3.9600.23470
- Windows Server 2022: builds 10.0.20348.0 to before 10.0.20348.5761
- Windows Server 2025 (including Server Core): builds 10.0.26100.0 to before 10.0.26100.33650
The NVD entry lists only Windows 10 1607; the CNA data lists the products above.
Fixed in
- Fixed builds per CNA data: 10.0.14393.9612, 10.0.17763.9376, 6.2.9200.26434, 6.3.9600.23470, 10.0.20348.5761, 10.0.26100.33650
- KB numbers per third-party mirrors: KB5126868 (14393.9612), KB5126655 (20348.5761), KB5126646 (26100.33650). KB numbers for the other builds are unknown.
- Verify all builds and KB numbers against the MSRC Security Update Guide before deployment.
Workaround
Unknown. No vendor-published workaround was found.
Exploitation
- Microsoft exploit maturity: Unproven (E:U).
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- VulDB: not listed in KEV.
- No public proof of concept or exploitation reports were found in generic searches. This is not a confirmed absence.
Our recommendation
- Patch all affected Windows DNS servers now, starting with domain controllers and any server reachable from the internet.
- Inventory all Windows DNS servers and their exact builds, including Server Core systems.
- Do not expose internal or recursive DNS servers directly to the internet, and restrict DNS access to the clients that need it.
- Monitor DNS server logs and crashes.
- Check whether your systems are still within vendor support, especially Windows 10 1607.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Role: DNS Server
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126836, KB5126868, KB5126651, KB5126655, KB5126646, KB5126835
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-96113 msrc.microsoft.com
- Zero Day Initiative: The October 2026 Security Update Review www.zerodayinitiative.com
- VulDB: CVE-2026-96113 vuldb.com
- Vulners (CIRCL): CVE-2026-96113 vulners.com
- Vulners (CVE list): CVE-2026-96113 vulners.com
- THREATINT: CVE-2026-96113 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:22.
Original description (NVD)
Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.