Windows Server DNS: Information disclosure through out-of-bounds read

Summary

A Windows DNS Server component in Windows Server 2016, 2019, 2022 and 2025 contains an out-of-bounds read (CWE-125). An authenticated attacker with high privileges on the network can read memory beyond the intended buffer and disclose information. Confidentiality is affected, while integrity and availability are not (CVSS 4.9, Medium). Exploitation requires high privileges, so the practical risk is mainly for internet-facing DNS servers or DNS servers on less trusted network segments.

Affected

• Windows Server 2016 (including Server Core) before 10.0.14393.9688
• Windows Server 2019 (including Server Core) before 10.0.17763.9487
• Windows Server 2022 before 10.0.20348.5870
• Windows Server 2025 (including Server Core) before 10.0.26100.33822 (per third-party aggregator; verify on MSRC)
• Windows client editions: Unknown.

Fixed in

• Install the November 2026 cumulative update for your Windows Server build (fixed builds as listed above).
• KB article numbers: Unknown.

Workaround

• No vendor-documented workaround found. Unknown whether one exists.
• Interim hardening: limit DNS server access to trusted internal networks and do not expose Windows DNS servers to the internet.

Exploitation

• Rapid7 rates it "Exploitation Less Likely" and lists it as not publicly disclosed.
• OffSeq reports no known exploitation as of 10 Nov 2026 (secondary, machine-generated source).
• CISA SSVC: Exploitation none, Automatable no.
• No CISA KEV listing, public proof of concept or in-the-wild exploitation found so far. The CVE is only one day old; recheck.

Our recommendation

• Apply the November 2026 cumulative update on Windows Server DNS servers as part of the standard monthly cycle.
• Expedite patching for DNS servers that are internet-facing or run on domain controllers in less trusted network segments.
• Restrict DNS server access to internal, trusted networks and limit high-privilege accounts.
• Monitor DNS traffic for malformed packets.
• Verify fixed builds and KB numbers on MSRC before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Security Update Guide - CVE-2026-96985 (MSRC) msrc.microsoft.com
• CVE Record CVE-2026-96985 www.cve.org
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• OffSeq Radar CVE-2026-96985 radar.offseq.com
• vuldb CVE-2026-96985 vuldb.com
• Strix.ai CVE-2026-96985 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:18.