CVE-2026-62787: Windows DNS Use After Free Vulnerability

CVE-2026-62787 Overview

CVE-2026-62787 is a use-after-free vulnerability in the Windows Domain Name System (DNS) service. An authorized attacker can trigger the flaw over a network to execute arbitrary code in the context of the DNS process. The weakness is tracked as [CWE-416] Use After Free and affects Windows DNS server components. Microsoft published the advisory on August 11, 2026, and the National Vulnerability Database updated the entry on August 12, 2026. Exploitation requires low privileges and no user interaction, but attack complexity is high because the attacker must win a memory-state race. Successful exploitation compromises confidentiality, integrity, and availability of the DNS service.

Critical Impact
Remote code execution against a core network infrastructure service can allow adversaries to poison DNS responses, pivot laterally, and disrupt name resolution across an enterprise.

Affected Products

Microsoft Windows DNS Server
Windows Server operating system releases supported by Microsoft as of August 2026
Environments running the Microsoft DNS Server role

Discovery Timeline

2026-08-11 - CVE-2026-62787 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-62787

Vulnerability Analysis

The vulnerability is a use-after-free condition inside the Windows DNS service. The service references a memory object after it has been released back to the allocator. An authorized attacker with network access can send crafted DNS traffic that forces this dangling reference to be dereferenced. When the freed memory is reallocated with attacker-influenced content, the DNS process operates on adversary-controlled data. This mismatch between object lifetime and object use enables arbitrary code execution within the DNS service context. Because DNS typically runs with elevated privileges on Windows Server, code execution here provides a strong pivot into Active Directory environments where DNS is co-located with domain controllers.

Root Cause

The root cause is improper memory lifetime management within the DNS server component. Object pointers remain valid to code paths after the underlying allocation is freed. The [CWE-416] classification indicates that reference counting, cleanup ordering, or synchronization between concurrent request handlers is defective. High attack complexity suggests the attacker must reliably shape heap state to place controlled data into the reclaimed allocation before the stale reference is used.

Attack Vector

The attack vector is network-based and requires low privileges on the target environment. An authorized attacker sends crafted DNS protocol messages to the vulnerable service. The messages must be sequenced to free an object and then trigger a subsequent code path that reuses the pointer. No user interaction is required. Microsoft's advisory for CVE-2026-62787 is the authoritative source for exploitation prerequisites. See the Microsoft Security Update CVE-2026-62787 advisory for vendor-specific detail.

// No verified proof-of-concept code is publicly available for CVE-2026-62787.
// Exploitation requires sequencing DNS protocol messages to free an internal
// object and then invoke a code path that dereferences the stale pointer
// while attacker-controlled data occupies the reclaimed allocation.

Detection Methods for CVE-2026-62787

Indicators of Compromise

Unexpected crashes or restarts of the dns.exe service on Windows Server hosts
Anomalous DNS query patterns targeting the DNS service, including malformed record types or oversized payloads
New or unusual child processes spawned by the DNS service account
Outbound network connections initiated by dns.exe to non-standard destinations

Detection Strategies

Monitor Windows Event Log for DNS service faults, application errors referencing dns.exe, and Windows Error Reporting entries tied to the DNS binary
Inspect DNS server logs for high volumes of malformed queries from a single low-privilege source
Correlate DNS process anomalies with authentication events to identify authorized but suspicious network principals

Monitoring Recommendations

Enable DNS analytical and audit logging on all Windows DNS servers
Forward DNS server telemetry and Windows Security events to a centralized SIEM for correlation
Baseline normal DNS process behavior, including memory footprint and child process creation, and alert on deviations
Track patch state of Windows DNS Server role across the estate

How to Mitigate CVE-2026-62787

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-62787 advisory to all Windows DNS servers
Restrict network access to the DNS service so that only trusted clients and forwarders can reach TCP and UDP port 53
Audit accounts with authorization to submit DNS updates and reduce privileges where feasible
Restart the DNS service after patching to ensure freed memory paths are reinitialized

Patch Information

Microsoft has issued a security update addressing CVE-2026-62787. Administrators should consult the Microsoft Security Update CVE-2026-62787 advisory for the specific KB article, affected Windows Server builds, and installation guidance. Deploy the update through Windows Update, Windows Server Update Services, or the enterprise patch management pipeline in use.

Workarounds

Segment DNS servers behind firewalls that filter DNS traffic to authorized sources only
Disable dynamic updates on zones that do not require them to reduce authenticated attack surface
Deploy DNS forwarders or resolvers in front of authoritative servers to inspect and drop malformed queries

bash

# Example: restrict inbound DNS on a Windows Server to specific subnets
New-NetFirewallRule -DisplayName "DNS-Restrict-Inbound" `
  -Direction Inbound -Protocol UDP -LocalPort 53 `
  -RemoteAddress 10.0.0.0/8 -Action Allow

New-NetFirewallRule -DisplayName "DNS-Block-Other" `
  -Direction Inbound -Protocol UDP -LocalPort 53 `
  -Action Block