CVE-2026-108128: DNS Server Information Disclosure Flaw

CVE-2026-108128 Overview

CVE-2026-108128 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Windows DNS Server. An authenticated attacker with low privileges can send crafted network requests to the DNS Server to read memory outside allocated buffers. Successful exploitation discloses sensitive process memory contents over the network. The flaw affects confidentiality only; integrity and availability remain unaffected per the CVSS vector. Microsoft published the advisory on October 13, 2026 through the Microsoft Security Response Center (MSRC) update guide.

Critical Impact
Authenticated remote attackers can read out-of-bounds memory from Windows DNS Server, exposing potentially sensitive data processed by the service.

Affected Products

Microsoft Windows DNS Server (see MSRC advisory for specific build and KB coverage)
Windows Server deployments running the DNS Server role
Environments where the DNS Server role accepts authenticated network input

Discovery Timeline

2026-10-13 - CVE-2026-108128 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108128

Vulnerability Analysis

The vulnerability resides in the Windows DNS Server component and is classified as an out-of-bounds read [CWE-125]. The DNS Server reads data past the end of an allocated buffer when processing attacker-supplied input. The read operation returns memory contents that may include fragments of other DNS records, cached responses, or internal server state.

The CVSS vector indicates network-reachable exploitation requiring low privileges and no user interaction. Impact is limited to information disclosure, with no integrity or availability impact reported by Microsoft. The EPSS probability sits near 0.95% as of October 15, 2026, reflecting low observed exploitation activity.

Root Cause

Out-of-bounds read conditions typically arise from missing or incorrect length validation before accessing a memory buffer. In the DNS Server context, the service likely parses a structured DNS message field without validating that the declared length matches the actual buffer size. The parser then reads past the buffer boundary and returns adjacent memory to the caller. Microsoft has not published root-cause detail beyond the MSRC advisory.

Attack Vector

Exploitation requires network access to the DNS Server and valid credentials with at least low privileges. The attacker crafts a DNS query or protocol message designed to trigger the vulnerable parsing path. The server responds with data that contains out-of-bounds memory contents, which the attacker captures and analyzes. No user interaction is required, and the attack does not change scope.

Refer to the Microsoft CVE-2026-108128 Advisory for protocol-level technical details.

Detection Methods for CVE-2026-108128

Indicators of Compromise

Unusual volumes of authenticated DNS queries from a single source targeting the DNS Server role
DNS responses containing anomalous payload sizes or malformed record structures
Repeated identical malformed queries that correlate with memory-probing patterns

Detection Strategies

Enable DNS Server analytical and audit logging to capture query content, source identity, and response size
Baseline normal DNS query patterns per authenticated principal and alert on statistical deviations
Correlate DNS Server event logs with endpoint and identity telemetry to identify abnormal query sources

Monitoring Recommendations

Forward Windows DNS Server event logs to a centralized SIEM for long-term retention and correlation
Monitor authenticated accounts that interact with the DNS Server role for anomalous query frequency or payload characteristics
Alert on process memory read patterns reported by endpoint telemetry on DNS Server hosts

How to Mitigate CVE-2026-108128

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-108128 to all DNS Server hosts
Inventory all Windows Servers running the DNS Server role and prioritize internet-reachable or multi-tenant systems
Review authenticated principals that can send queries to the DNS Server and revoke unnecessary access

Patch Information

Microsoft published the official fix through the MSRC update guide. Administrators should consult the Microsoft CVE-2026-108128 Advisory for the specific Knowledge Base article, affected build numbers, and cumulative update packages applicable to each Windows Server version.

Workarounds

Restrict DNS Server access to trusted network segments using host-based and network firewall rules
Enforce least-privilege authentication on the DNS Server and remove unused service accounts
Enable enhanced DNS logging to detect exploitation attempts until patches are deployed

bash

# Example: Restrict DNS Server inbound access to a trusted subnet on Windows
New-NetFirewallRule -DisplayName "Restrict DNS Server Inbound" `
  -Direction Inbound -Protocol UDP -LocalPort 53 `
  -RemoteAddress 10.0.0.0/8 -Action Allow

New-NetFirewallRule -DisplayName "Block Other DNS Inbound" `
  -Direction Inbound -Protocol UDP -LocalPort 53 `
  -Action Block