Windows DNS Server: Denial of service through use-after-free
Summary
A use-after-free vulnerability in the Windows DNS Server component allows an unauthenticated attacker on an adjacent network to cause a denial of service. Successful exploitation can crash or stall the DNS service, which only affects availability. The attack requires high attack complexity and an attacker on the same network segment.
Affected
- Windows 10 Version 1607, 1809, 21H2, 22H2 (per CVE record)
- Windows 11 Versions 23H2, 24H2, 25H2, 26H1, 26H2 (per CVE record)
- Windows Server 2016, 2019, 2022 (including Server Core installations, per CVE record)
- Exact affected build ranges: see the CVE record and MSRC advisory
Fixed in
- Windows 10 1607: 10.0.14393.9688 or later (per CVE record)
- Windows 10 1809: 10.0.17763.9487 or later (per CVE record)
- Windows 10 21H2, 22H2, Windows 11, Windows Server 2022: fixed builds listed in the CVE record (10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.26300.9974, 10.0.28000.3501, 10.0.20348.5870)
- Unconfirmed: the KB number for the November 2026 update has not been verified; check MSRC before rollout
Workaround
- Unknown. No vendor-published workaround found.
- Interim measure (recommendation, not a vendor statement): restrict access to DNS servers to known clients and segment the network.
Exploitation
- CISA SSVC: exploitation none, not automatable.
- Rapid7 rates exploitation as unlikely and not publicly disclosed.
- Public proof of concept: unknown.
Our recommendation
- Identify hosts running the DNS Server role, including domain controllers.
- Install the November 2026 security update or the fixed build from MSRC on affected DNS servers, prioritising flat networks and guest or IoT segments.
- Restrict which devices can reach DNS servers and monitor for service crashes or restarts.
- Verify the exact fixed builds on the MSRC advisory before rollout.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Denial of service – Windows DNS
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation unlikely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record (CVE.org) www.cve.org
- Microsoft Security Update Guide msrc.microsoft.com
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- VulDB CVE-2026-96983 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:17.
Original description (NVD)
Use after free in Windows DNS allows an unauthorized attacker to deny service over an adjacent network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.