Windows DNS Server heap-based buffer overflow allows remote code execution (CVE-2026-96113)

What happened

Microsoft's October 2026 security release fixes a heap-based buffer overflow in Windows DNS Server. An attacker who can reach a vulnerable DNS server over the network can trigger the flaw without authentication and without any user interaction. Successful exploitation lets the attacker execute code on the target system, with high impact to confidentiality, integrity and availability.

The CVSS 3.1 vector rates this 9.8 critical because the attack is network-based, has low complexity, and needs no privileges or user interaction. Microsoft's own advisory rates the issue Important. Microsoft has not stated that the vulnerability has been exploited, and it is not listed in CISA's KEV catalogue; the CVE record does not indicate public disclosure.

Who is affected

Microsoft lists the DNS Server component on these releases as affected:

• Windows Server 2012 and Server Core: builds before 6.2.9200.26434
• Windows Server 2012 R2 and Server Core: builds before 6.3.9600.23470
• Windows 10 1607, Windows Server 2016 and Server Core: builds before 10.0.14393.9612
• Windows 10 1809, Windows Server 2019 and Server Core: builds before 10.0.17763.9376
• Windows Server 2022: builds before 10.0.20348.5761
• Windows Server 2025 and Server Core: builds before 10.0.26100.33650

Because the vulnerable service is reachable over the network, any DNS Server role on these builds should be treated as exposed until patched.

What to do now

1. Apply Microsoft's October 2026 security updates. The fixed builds are:

• Windows Server 2012 / Server Core: 6.2.9200.26434 (KB5126835)
• Windows Server 2012 R2 / Server Core: 6.3.9600.23470 (KB5126836)
• Windows 10 1607, Windows Server 2016 / Server Core: 10.0.14393.9612 (KB5126868)
• Windows 10 1809, Windows Server 2019 / Server Core: 10.0.17763.9376 (KB5126651)
• Windows Server 2022: 10.0.20348.5761 (KB5126655)
• Windows Server 2025 / Server Core: 10.0.26100.33650 (KB5126646)

1. Prioritise hosts where the DNS Server role is enabled and reachable from untrusted networks.

1. Microsoft has not published a workaround. If patching cannot be done immediately, restrict access to DNS services to trusted clients and monitor the DNS service for unexpected behaviour.

How to detect it

Microsoft has not published indicators of compromise for this CVE. Because the flaw is triggered over the network without authentication, identify DNS servers reachable from untrusted zones and confirm they are on the fixed builds listed above.

Beyond the patch

An unauthenticated network service is an exposure problem, not only a patch problem. Our Virtual CISO Services (vCISO) can help you inventory internet-facing Windows DNS servers and reduce the paths an attacker would use, while Managed Detection & Response (MDR) watches for post-exploitation activity if a service is compromised before patching. Apply the update first, then put those controls in place.