CVE-2026-70155: Windows DNS Memory Leak DoS Vulnerability

CVE-2026-70155 Overview

CVE-2026-70155 is a memory leak vulnerability in Windows DNS that allows an unauthenticated remote attacker to cause a denial of service. The flaw stems from missing release of memory after effective lifetime, classified as [CWE-401]. An attacker can send crafted network traffic to the affected DNS service to progressively exhaust server memory. No authentication or user interaction is required to trigger the condition.

Critical Impact
Unauthenticated remote attackers can exhaust system memory on Windows DNS servers, degrading or disabling name resolution services across dependent infrastructure.

Affected Products

Microsoft Windows DNS
Windows Server installations with the DNS Server role enabled
Refer to the Microsoft CVE-2026-70155 Update Guide for the full list of affected builds

Discovery Timeline

2026-10-13 - CVE-2026-70155 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-70155

Vulnerability Analysis

The vulnerability resides in the Windows DNS service and is categorized as a memory leak ([CWE-401]). The service allocates memory to process incoming DNS requests but fails to free that memory after the request lifecycle completes. Each malicious request consumes additional memory that is never reclaimed.

Attackers reach the vulnerable code path over the network without credentials or user interaction. Sustained exploitation drives the DNS process memory footprint higher until the service becomes unresponsive or the host exhausts available memory. Confidentiality and integrity are not affected, but availability degrades significantly.

Root Cause

The root cause is improper resource lifecycle management inside the Windows DNS service. One or more code paths allocate memory for request processing but do not release the allocation on all exit paths. Repeated invocation of the leaky path accumulates orphaned allocations in the DNS process heap.

Attack Vector

The attack vector is network-based with low complexity. An attacker sends a stream of specially formed DNS queries or messages to an exposed Windows DNS server. Each request leaks a small amount of memory. Volume-based exploitation over time exhausts resources, which can cascade into failed authentication, outbound connectivity loss, and Active Directory disruption across the environment.

No verified public proof-of-concept is available at this time. See the Microsoft CVE-2026-70155 Update Guide for technical specifics.

Detection Methods for CVE-2026-70155

Indicators of Compromise

Steady, unexplained growth of the dns.exe process working set and private bytes over hours or days
High-volume inbound DNS traffic from a narrow set of external source addresses targeting UDP/TCP port 53
DNS service restarts, crashes, or SCM recovery events on affected Windows Servers
Client-side name resolution failures correlated with increased server memory pressure

Detection Strategies

Baseline dns.exe memory usage per server and alert on sustained upward trends outside normal variance
Monitor Windows Event Log for DNS Server service events indicating restarts, errors, or resource warnings
Correlate inbound DNS query rates with memory counters to identify low-and-slow exhaustion patterns
Inspect DNS query logs for repeated malformed or unusual record type requests from the same source

Monitoring Recommendations

Enable DNS debug or analytical logging on servers exposed to untrusted networks
Ship Windows performance counters and DNS logs to a centralized analytics backend for correlation
Set alert thresholds on process private bytes, system committed memory, and DNS query error rates

How to Mitigate CVE-2026-70155

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-70155 Update Guide as soon as it is available for your build
Restrict inbound DNS traffic on internet-facing resolvers to known clients where feasible
Monitor dns.exe memory consumption and configure automated service recovery to restore availability during exhaustion
Rate-limit DNS queries at the network edge to blunt volumetric exploitation attempts

Patch Information

Microsoft tracks the fix through the official update guide. Administrators should consult the Microsoft CVE-2026-70155 Update Guide for KB identifiers, affected Windows Server versions, and installation instructions. Apply the patch to all servers running the DNS Server role, including read-only domain controllers that host DNS.

Workarounds

Place vulnerable DNS servers behind a filtering resolver or firewall that enforces query rate limits
Disable the DNS Server role on hosts that do not require it until patches are deployed
Configure Windows Service Recovery to automatically restart dns.exe after failure to reduce outage duration
Segment management and client DNS traffic so external attackers cannot reach internal authoritative servers