CVE-2026-72987: Windows DNS Use After Free Vulnerability

CVE-2026-72987 Overview

CVE-2026-72987 is a use-after-free vulnerability [CWE-416] in Windows Domain Name System (DNS) that allows an unauthenticated attacker to execute code over a network. The flaw affects the DNS service component in Microsoft Windows and requires no user interaction. Successful exploitation can compromise the confidentiality, integrity, and availability of the target system. Microsoft published details through its Security Update Guide, and the vulnerability was disclosed on September 8, 2026.

Critical Impact
An unauthenticated remote attacker can trigger memory corruption in the Windows DNS service to achieve arbitrary code execution in the service context.

Affected Products

Microsoft Windows (DNS component)
Windows Server DNS service roles
Refer to the Microsoft Security Update Guide for the complete affected build list

Discovery Timeline

2026-09-08 - CVE-2026-72987 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-72987

Vulnerability Analysis

The vulnerability is a use-after-free condition in the Windows DNS service. The service references a memory object after that object has been freed, allowing an attacker to influence the contents of the reclaimed allocation. When the dangling pointer is later dereferenced, the attacker gains control over program flow within the DNS service process. Exploitation occurs across the network and requires no privileges or user interaction, though the attack complexity is high because it depends on winning a memory reuse race and shaping heap state remotely.

Root Cause

The root cause is improper lifetime management of a heap-allocated object in the DNS request handling path. A code path releases the object while another reference remains valid, producing a dangling pointer that is dereferenced during subsequent DNS processing. This class of defect is tracked as [CWE-416].

Attack Vector

The attack vector is network based. An attacker sends specially crafted DNS traffic to a vulnerable Windows DNS server. By manipulating message ordering and content, the attacker triggers the object free while retaining a reference used later in processing. Successful reuse of the freed allocation enables arbitrary code execution in the DNS service context, which typically runs with elevated privileges on Windows Server systems.

No verified public proof-of-concept code is available at the time of publication. See the Microsoft Security Update Guide entry for CVE-2026-72987 for technical details.

Detection Methods for CVE-2026-72987

Indicators of Compromise

Unexpected termination or restart of the DNS service (dns.exe) on Windows Server hosts
Anomalous crash dumps or Windows Error Reporting entries referencing the DNS service
Unusual outbound connections or child processes spawned from dns.exe
Malformed or high-volume DNS query patterns targeting internal DNS servers

Detection Strategies

Monitor Windows Event Log sources DNS-Server-Service and Application Error for repeated crashes or access violations in dns.exe.
Alert on process creation where the parent process is dns.exe, since the DNS service should not spawn command shells or scripting hosts.
Correlate DNS service crashes with inbound DNS traffic bursts from a single source or subnet.

Monitoring Recommendations

Enable DNS analytical and audit logging on Windows DNS servers and forward events to a centralized SIEM.
Baseline normal DNS query volume and query type distribution to detect anomalous protocol activity.
Track memory and handle usage of dns.exe for signs of instability preceding exploitation attempts.

How to Mitigate CVE-2026-72987

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-72987 to all Windows DNS servers.
Prioritize patching internet-exposed and internal recursive DNS servers that accept queries from untrusted networks.
Inventory all Windows Server hosts running the DNS Server role and confirm patch status after deployment.

Patch Information

Microsoft has released a security update addressing this vulnerability. Consult the Microsoft Security Update Guide entry for CVE-2026-72987 for the KB numbers, affected Windows versions, and installation guidance corresponding to your environment.

Workarounds

Restrict inbound DNS traffic (UDP/TCP 53) to trusted networks and known upstream resolvers using host and network firewalls.
Disable the DNS Server role on hosts where it is not required.
Segment DNS infrastructure so that internet-facing resolvers cannot pivot to internal Active Directory integrated DNS servers.

bash

# Configuration example: restrict inbound DNS to trusted subnets on Windows
New-NetFirewallRule -DisplayName "Restrict DNS Inbound" `
    -Direction Inbound `
    -Protocol UDP `
    -LocalPort 53 `
    -RemoteAddress 10.0.0.0/8 `
    -Action Allow

New-NetFirewallRule -DisplayName "Block DNS Inbound Untrusted" `
    -Direction Inbound `
    -Protocol UDP `
    -LocalPort 53 `
    -Action Block