Key points
- CVE-2026-96113 affects Windows Domain Name Service.
- The vulnerability is a heap-based buffer overflow.
- Attackers can execute code over a network without prior access.
Microsoft has identified a critical remote code execution vulnerability within its Windows Domain Name Service infrastructure. Designated as CVE-2026-96113, this security flaw enables unauthorised attackers to execute arbitrary code over a network. The National Vulnerability Database assigns the issue a CVSS score of 9.8, categorising it as critical severity.
In plain English
The core problem lies in how the Windows DNS Server handles data in memory. Specifically, a heap-based buffer overflow occurs when the service processes certain inputs. This error allows an attacker to send malicious data that the server cannot safely contain. Consequently, the attacker gains the ability to run their own code on the affected system remotely.
The background
According to the official Microsoft Security Update Guide, the vulnerability resides in the DNS Server component. It is classified under CWE-122 and CWE-197 weaknesses. The advisory states that an unauthorised attacker can exploit this issue over a network. No specific versions of Windows were listed in the provided source material as being uniquely affected, but the service itself is the target.
What changes now
Organisations using Windows DNS Server must treat this issue with urgency due to its critical rating. Because the flaw allows remote code execution without prior authentication, the attack surface is significant. Managed service providers should verify if their clients run this service. No fix has been confirmed yet in the provided source material, so exposure remains active until a fix is issued.
The attacker's path
Teams usually monitor DNS traffic for unusual spikes or malformed packets that might signal exploitation attempts. Check whether network segmentation isolates DNS servers from general user networks. This stage of an intrusion typically serves as an initial foothold, allowing lateral movement. Verify that logging captures detailed request headers to aid forensic analysis later. Ensure that monitoring tools alert on unexpected process spawns on DNS hosts.
What to do and how to stay safe: Windows DNS Server
- Verify if your clients run the Windows DNS Server service and identify exposed instances.
- Monitor network logs for anomalous traffic patterns targeting DNS ports.
- Apply temporary network restrictions to limit access to DNS servers from untrusted zones.
- Prepare to deploy the official update once the vendor provides a confirmed fix.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-96113?
The National Vulnerability Database rates the vulnerability as 9.8, which is critical.
Can an attacker exploit this without logging in first?
Yes, the advisory states it allows an unauthorised attacker to execute code over a network.
What type of bug is this?
It is a heap-based buffer overflow in the Windows Domain Name Service.
