CVE-2026-88123: DNS Server Out-of-Bounds Read DoS Flaw

CVE-2026-88123 Overview

CVE-2026-88123 is an out-of-bounds read vulnerability [CWE-125] in Microsoft DNS Server. An authorized attacker can trigger the flaw over the network to cause a denial-of-service condition. Successful exploitation disrupts DNS resolution services, impacting dependent applications, authentication flows, and internal name resolution across affected environments.

The vulnerability requires low privileges, no user interaction, and can be triggered remotely. Microsoft has published a security advisory addressing the issue. While confidentiality and integrity remain intact, the availability impact is high because DNS outages cascade across directory services and client workloads.

Critical Impact
Authorized network attackers can crash or destabilize Microsoft DNS Server, disrupting name resolution across the environment.

Affected Products

Microsoft DNS Server (see Microsoft Security Update Guide for specific builds)

Discovery Timeline

2026-10-13 - CVE-2026-88123 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-88123

Vulnerability Analysis

The flaw resides in the DNS Server component's handling of protocol data. When processing a crafted DNS message, the server reads memory outside the bounds of an allocated buffer. The out-of-bounds read corrupts internal state or triggers an access violation, terminating the DNS service process.

Because DNS underpins Active Directory, email routing, and most client-server communications, a service crash propagates failures far beyond the DNS host itself. The CWE-125 classification confirms the issue stems from improper validation of input length or offset values before a memory read operation.

Root Cause

The root cause is missing or insufficient bounds checking on input used to compute a read offset within a DNS message parser. Microsoft has not published the specific function or structure involved. Technical readers should consult the Microsoft Security Update Guide for authoritative details once Microsoft releases additional information.

Attack Vector

Exploitation requires network access to the DNS Server and valid authentication at a low privilege level. The attacker sends a specially crafted DNS request or update message to the vulnerable server. No user interaction is required. The result is denial of service against the DNS process, not code execution or data disclosure. Public proof-of-concept code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

// No verified exploit code is available.
// Refer to the Microsoft Security Update Guide for technical details.

Detection Methods for CVE-2026-88123

Indicators of Compromise

Unexpected termination or repeated restarts of the DNS service (dns.exe) on Windows Server hosts.
Windows Event Log entries for Service Control Manager showing the DNS Server service entering a stopped state.
Application crash events (Event ID 1000) referencing dns.exe with access violation exception codes.
Spikes in malformed or oversized DNS queries from authenticated internal sources.

Detection Strategies

Monitor DNS service health and process uptime; alert on unexpected restarts or hangs.
Inspect DNS query logs for anomalous packet structures, unusual record types, or oversized payloads from authenticated clients.
Correlate DNS service crashes with recent authentication events to identify the originating account.

Monitoring Recommendations

Enable DNS analytical and audit logging on Windows DNS Servers to capture query metadata.
Forward Windows Event Logs and DNS logs to a centralized SIEM for correlation and retention.
Baseline normal DNS query volume and packet size, then alert on statistical deviations.

How to Mitigate CVE-2026-88123

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is available for your Windows Server version.
Restrict DNS Server access to trusted network segments and authenticated clients that require it.
Review authenticated accounts with DNS management or update privileges and remove unused credentials.
Enable automatic recovery actions on the DNS service to limit outage duration if a crash occurs.

Patch Information

Microsoft tracks remediation through the Microsoft Security Update Guide. Administrators should install the cumulative update or standalone patch mapped to CVE-2026-88123 for their specific Windows Server build. Verify patch deployment through Windows Update, WSUS, or an endpoint management solution, and confirm the DNS Server version post-install.

Workarounds

Segment DNS Servers behind firewalls that restrict inbound DNS traffic to known resolvers and clients.
Deploy redundant DNS Servers so a single service crash does not interrupt name resolution.
Rate-limit DNS requests from individual authenticated sources to reduce exploitation surface.

bash

# Example: restart policy for the Windows DNS Server service
sc.exe failure DNS reset= 86400 actions= restart/5000/restart/5000/restart/5000