CVE-2026-88129: DNS Server Out-of-Bounds Read DoS Flaw

CVE-2026-88129 Overview

CVE-2026-88129 is an out-of-bounds read vulnerability [CWE-125] in Microsoft DNS Server. An authorized attacker can trigger the flaw over a network to cause a denial-of-service condition against the DNS service. Microsoft published the advisory on October 13, 2026.

The vulnerability affects the availability of DNS resolution services. Successful exploitation does not expose confidential data or allow modification of records. Because DNS underpins directory services, email routing, and web traffic within enterprise environments, service disruption can cascade across dependent systems.

Critical Impact
An authenticated remote attacker can crash or hang the Microsoft DNS Server service, disrupting name resolution for all downstream clients and services that depend on it.

Affected Products

Microsoft DNS Server (see the Microsoft Security Update Guide for the full list of affected Windows Server versions and build numbers)

Discovery Timeline

2026-10-13 - CVE-2026-88129 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-88129

Vulnerability Analysis

The flaw is classified as an out-of-bounds read [CWE-125] in the Microsoft DNS Server component. The service reads memory beyond the bounds of an allocated buffer when processing attacker-influenced input. The resulting access violation terminates or destabilizes the DNS Server process.

The attack requires network access and valid low-privilege authentication. No user interaction is needed, and the scope remains unchanged. Confidentiality and integrity are not affected, but availability impact is high because the DNS service becomes unresponsive.

According to Microsoft's advisory, the vulnerability is exploitable remotely by an authorized actor. The EPSS probability for near-term exploitation is approximately 1.09%.

Root Cause

The root cause is improper validation of a length or offset value during parsing of a DNS protocol structure. When the server reads past the end of the intended buffer, the operating system raises an access violation. The DNS service does not safely recover from this condition, which results in a crash of the resolver process.

Attack Vector

An attacker authenticated to the target environment sends a crafted DNS message to a vulnerable Microsoft DNS Server. Processing of the malformed structure triggers the out-of-bounds read. The service terminates and name resolution requests from clients begin to fail. Repeated requests can prevent the service from stabilizing after restart.

No public proof-of-concept code is available at the time of publication. Technical specifics are limited to the information disclosed in the Microsoft Security Update Guide.

Detection Methods for CVE-2026-88129

Indicators of Compromise

Unexpected termination or restart of the DNS service (dns.exe) on Windows Server hosts.
Windows Event Log entries indicating an application crash in dns.exe with an access violation exception code (0xC0000005).
Spikes in DNS query failures or client-side name resolution timeouts coincident with service restarts.
Inbound DNS queries from authenticated internal sources with malformed or unusually structured payloads.

Detection Strategies

Monitor Windows Service Control Manager events for repeated DNS Server service stop and start sequences within short time windows.
Correlate DNS service crashes with authenticated network sessions to identify the originating client.
Alert on Windows Error Reporting entries referencing the DNS Server binary.

Monitoring Recommendations

Enable DNS diagnostic logging and forward events to a centralized SIEM for correlation.
Track DNS service availability metrics and set thresholds that alert on any unplanned service restart.
Review authentication logs for the accounts active at the time of DNS service crashes.

How to Mitigate CVE-2026-88129

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows Server DNS roles.
Prioritize patching of internet-facing and authoritative DNS servers that handle production zones.
Audit which accounts hold network-level access to internal DNS infrastructure and revoke unnecessary privileges.
Validate that secondary DNS servers are healthy and able to absorb load if a primary server fails.

Patch Information

Microsoft has released a security update addressing CVE-2026-88129. Refer to the Microsoft Security Update Guide entry for the specific KB article, build numbers, and deployment guidance that match each affected Windows Server version.

Workarounds

Restrict inbound DNS traffic to the server using host-based or network firewalls so that only trusted resolver clients can submit queries.
Deploy redundant DNS servers behind a load balancer or secondary resolver configuration to maintain availability during a service disruption.
Enforce network segmentation so that only authenticated administrative networks can reach management and recursive query interfaces of the DNS service.

bash

# Example: restrict inbound DNS to known subnets using Windows Firewall
New-NetFirewallRule -DisplayName "DNS-In-Allow-Trusted" `
  -Direction Inbound -Protocol UDP -LocalPort 53 `
  -RemoteAddress 10.0.0.0/8,192.168.0.0/16 -Action Allow

New-NetFirewallRule -DisplayName "DNS-In-Block-Other" `
  -Direction Inbound -Protocol UDP -LocalPort 53 `
  -Action Block