CVE-2026-65797: Windows DNS Privilege Escalation Flaw

CVE-2026-65797 Overview

CVE-2026-65797 is a numeric truncation error in the Windows Domain Name System (DNS) component. The flaw allows an authorized local attacker to elevate privileges on an affected system. Microsoft categorizes the underlying weakness as a heap-based buffer overflow ([CWE-122]) triggered by improper handling of numeric values that lose precision during conversion.

Successful exploitation grants the attacker high impact against confidentiality, integrity, and availability on the target host. The vulnerability requires local access and high privileges to trigger, but no user interaction. See the Microsoft Security Update CVE-2026-65797 advisory for vendor guidance.

Critical Impact
An authorized local attacker can elevate privileges on a Windows host running the affected DNS component, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft Windows (DNS component) — specific builds listed in the Microsoft advisory
Windows Server roles running the DNS Server service
Windows client systems using the affected DNS component

Discovery Timeline

2026-08-11 - CVE-2026-65797 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-65797

Vulnerability Analysis

The vulnerability is a numeric truncation error in the Windows DNS component. Truncation occurs when a value stored in a larger integer type is copied into a smaller type, discarding the high-order bits. When the truncated value drives a subsequent memory allocation or length check, downstream code operates on a buffer that is smaller than the data written into it.

Microsoft maps the underlying weakness to [CWE-122], a heap-based buffer overflow. The truncation path produces an undersized heap allocation, and the subsequent write overflows adjacent heap memory. Corrupting heap metadata or adjacent object pointers gives the attacker a primitive for privilege escalation within the DNS service context.

Exploitation requires an authorized local user with high privileges. The attack does not require user interaction. The scope is unchanged, meaning the compromise stays within the security authority that owns the DNS process, but that context on Windows Server typically runs with SYSTEM-level rights.

Root Cause

The root cause is improper handling of an integer conversion inside DNS record or query processing. A wider integer is narrowed without validation, and the truncated value is used as a length or index for a heap buffer. This mismatch between the true data size and the allocated buffer size creates the overflow condition.

Attack Vector

The attack vector is local. An authenticated attacker with existing privileges on the host submits crafted input to the DNS component to reach the vulnerable truncation path. Successful exploitation elevates the attacker to the privilege level of the DNS service, typically SYSTEM on Windows Server. No verified public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code has been published. Refer to the Microsoft Security Update CVE-2026-65797 advisory for authoritative technical detail.

Detection Methods for CVE-2026-65797

Indicators of Compromise

Unexpected crashes or restarts of the DNS Server service (dns.exe) with heap corruption exceptions in the Windows Application event log
New processes spawned as SYSTEM from the DNS service parent, especially interactive shells or scripting hosts
Anomalous modifications to DNS zone files, registry keys under HKLM\SYSTEM\CurrentControlSet\Services\DNS, or DNS service configuration

Detection Strategies

Alert on dns.exe faulting modules and Windows Error Reporting entries that indicate heap corruption on domain controllers or DNS servers
Correlate local logons by privileged accounts with subsequent abnormal child processes of the DNS service
Hunt for privilege-escalation behaviors on hosts with the DNS Server role, including token manipulation and access to LSASS from DNS-adjacent processes

Monitoring Recommendations

Ingest Windows Security, System, and Application event logs from every DNS server into a centralized analytics platform for correlation
Baseline normal DNS service memory usage and child-process activity so deviations are flagged automatically
Monitor for post-exploitation activity such as new local administrators, scheduled tasks, and service installations on DNS hosts

How to Mitigate CVE-2026-65797

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-65797 advisory to all affected Windows hosts
Prioritize patching domain controllers and other servers running the DNS Server role, since these are the highest-value targets
Audit local accounts on DNS hosts and remove unneeded high-privilege access to reduce the pool of users who satisfy the exploitation precondition

Patch Information

Microsoft has published a security update for CVE-2026-65797 in its update guide. Administrators should identify the applicable Knowledge Base article for each affected Windows version and deploy through Windows Update, Windows Server Update Services, or their standard patch-management workflow. Verify successful installation by confirming the build number after reboot.

Workarounds

No official workaround has been published by Microsoft; installing the security update is the supported remediation path
Restrict local logon rights on DNS servers to a minimum set of administrators to limit exposure until patching completes
Isolate DNS servers on segmented management networks and enforce just-in-time administrative access where possible

bash

# Verify installed updates on a Windows DNS server
wmic qfe list brief /format:table

# Confirm the DNS Server service state and binary version
Get-Service DNS
Get-Item "$env:SystemRoot\System32\dns.exe" | Select-Object VersionInfo