CVE-2026-72928: Windows DNS Use After Free Vulnerability

CVE-2026-72928 Overview

CVE-2026-72928 is a use-after-free vulnerability [CWE-416] in the Windows Domain Name System (DNS) component. An authorized attacker can trigger the flaw over a network to execute arbitrary code within the DNS service context. Microsoft published the advisory on 2026-09-08.

The issue affects the memory management logic of the Windows DNS service. Successful exploitation requires low-privilege authenticated access and high attack complexity, but yields full impact on confidentiality, integrity, and availability. Refer to the Microsoft Security Update Guide - CVE-2026-72928 for vendor guidance.

Critical Impact
Successful exploitation enables remote code execution in the Windows DNS service, potentially compromising the host and DNS resolution integrity across the environment.

Affected Products

Microsoft Windows DNS (see the Microsoft Security Update Guide - CVE-2026-72928 for the complete list of affected Windows versions)

Discovery Timeline

2026-09-08 - CVE-2026-72928 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in the NVD database

Technical Details for CVE-2026-72928

Vulnerability Analysis

The vulnerability is a use-after-free condition in the Windows DNS service. Use-after-free bugs occur when code references memory after it has been freed, allowing an attacker to influence the contents of that memory before dereference. In DNS server code paths, this typically arises from asynchronous handling of query state, cache entries, or record objects whose lifetimes are not correctly synchronized.

An authenticated attacker who can reach the DNS service over the network can craft request sequences that free an internal object and then cause the service to reuse the stale pointer. Reliable exploitation requires precise timing, which is reflected in the high attack complexity rating.

Successful exploitation runs attacker-controlled code in the security context of the DNS service. On a Windows DNS server that is also a domain controller, this represents a direct path to domain compromise.

Root Cause

The root cause is improper object lifetime management inside the Windows DNS service. A code path releases a heap-allocated structure while another path retains a reference and later dereferences it, creating a classic use-after-free window. Microsoft has not published low-level internals for this specific defect.

Attack Vector

The attack vector is network-based and requires the attacker to hold valid, low-privilege credentials on the target. The adversary sends a sequence of crafted DNS-related requests to the vulnerable service to trigger the free-and-reuse condition. No user interaction is required.

See the Microsoft Security Update Guide - CVE-2026-72928 for authoritative technical detail. Public proof-of-concept code and evidence of in-the-wild exploitation are not available at the time of writing.

Detection Methods for CVE-2026-72928

Indicators of Compromise

Unexpected crashes, restarts, or access-violation events for the dns.exe service process in the Windows Event Log.
Anomalous child processes spawned by dns.exe, particularly script interpreters, cmd.exe, or powershell.exe.
Outbound network connections initiated from the DNS service to non-DNS destinations or unusual ports.

Detection Strategies

Monitor for authenticated DNS traffic patterns that deviate from baseline, including high-volume or malformed queries directed at specific DNS servers.
Alert on process lineage anomalies where dns.exe acts as a parent to non-DNS binaries.
Correlate DNS service crash events with subsequent authentication or lateral movement activity from the same source.

Monitoring Recommendations

Enable and forward DNS server diagnostic and analytical logs to a central log platform for retention and analysis.
Track patch state of Windows DNS servers, especially domain controllers running the DNS role, to identify unpatched hosts.
Watch for privilege escalation activity or new service and scheduled task creation on DNS servers following any service disruption.

How to Mitigate CVE-2026-72928

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide - CVE-2026-72928 to all Windows systems running the DNS role.
Prioritize patching for DNS servers that are also domain controllers or that serve authoritative zones exposed to lower-trust networks.
Audit accounts with network access to DNS servers and remove or restrict credentials that are not required.

Patch Information

Microsoft has issued a security update addressing CVE-2026-72928. Consult the Microsoft Security Update Guide - CVE-2026-72928 for the specific KB articles and build numbers that apply to each supported Windows Server version.

Workarounds

Restrict network reachability of the Windows DNS service to trusted management and client subnets using host-based and network firewalls.
Enforce least-privilege authentication policies so that only required accounts can reach the DNS service.
Increase monitoring on unpatched DNS servers until updates can be deployed.

bash

# Configuration example
# Refer to Microsoft's security update guide for authoritative mitigation steps
# https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72928