CVE-2026-65789: Windows DNS Use-After-Free Vulnerability

CVE-2026-65789 Overview

CVE-2026-65789 is a use-after-free vulnerability [CWE-416] in the Windows Domain Name System (DNS) service. An unauthorized remote attacker can trigger the flaw over a network and execute arbitrary code in the context of the DNS service. Successful exploitation compromises confidentiality, integrity, and availability of the affected host.

Microsoft published the advisory on August 11, 2026. The vulnerability requires no authentication and no user interaction, though the attack complexity is rated high. No public proof-of-concept code or in-the-wild exploitation has been reported at the time of writing.

Critical Impact
Remote unauthenticated code execution against Windows DNS servers, which typically run on domain controllers and infrastructure hosts.

Affected Products

Windows DNS (see the Microsoft Security Advisory for the current list of affected builds)

Discovery Timeline

2026-08-11 - CVE CVE-2026-65789 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-65789

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the Windows DNS service. A use-after-free occurs when code accesses a heap object after it has been released, leading to memory corruption. An attacker who reliably grooms the heap and controls the freed object's contents can redirect execution flow.

Because the attack vector is network based and no privileges or user interaction are required, an attacker can reach vulnerable DNS listeners directly. Successful exploitation yields code execution in the security context of the DNS service, which frequently runs with SYSTEM-level privileges on Windows Server.

Root Cause

The root cause is improper lifetime management of a DNS-related object. The service continues to reference memory after it has been freed, allowing an attacker to influence subsequent allocations and control the reused memory region.

Attack Vector

Exploitation occurs over the network by sending crafted DNS traffic to a vulnerable server. The high attack complexity indicates that reliable exploitation likely requires precise timing, heap grooming, or specific server state. Refer to the Microsoft Security Advisory for authoritative technical details.

No verified public exploit code is available. Technical specifics of the affected code path have not been disclosed by Microsoft at this time.

Detection Methods for CVE-2026-65789

Indicators of Compromise

Unexpected crashes or restarts of the DNS service on Windows Server hosts
Anomalous inbound DNS traffic containing malformed or oversized records to authoritative or recursive resolvers
New child processes spawned by dns.exe or unusual outbound connections from the DNS service account

Detection Strategies

Monitor Windows Event Log for DNS service crashes, Application Error events, and Windows Error Reporting entries referencing dns.exe
Inspect network telemetry for high-entropy or malformed DNS packets, especially fragmented responses and unusual record types directed at internal DNS servers
Correlate DNS service faults with subsequent process creation or lateral movement from the affected host

Monitoring Recommendations

Enable DNS analytical and audit logging on all Windows DNS servers and forward events to a central SIEM
Alert on any process creation where the parent is dns.exe, which is not expected under normal operation
Track outbound network connections initiated by the DNS service account and flag deviations from baseline

How to Mitigate CVE-2026-65789

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Advisory to all Windows DNS servers
Prioritize patching internet-exposed and domain controller DNS instances first
Inventory hosts running the Windows DNS Server role and confirm patch deployment through configuration management tooling

Patch Information

Microsoft has released updates addressing CVE-2026-65789. Consult the Microsoft Security Advisory for the specific KB articles and affected build numbers applicable to your environment.

Workarounds

Restrict inbound DNS traffic to trusted networks using host and perimeter firewalls where operationally feasible
Segment DNS servers so that only required clients and forwarders can reach TCP/UDP port 53
If a DNS server is not required, disable the DNS Server role until patches can be applied

bash

# Verify the DNS Server role status on Windows Server
Get-WindowsFeature -Name DNS

# Restrict inbound DNS to a trusted management subnet (example)
New-NetFirewallRule -DisplayName "Restrict DNS Inbound" \
  -Direction Inbound -Protocol UDP -LocalPort 53 \
  -RemoteAddress 10.0.0.0/8 -Action Allow