CVE-2026-96113: DNS Server Buffer Overflow Vulnerability

CVE-2026-96113 Overview

CVE-2026-96113 is a heap-based buffer overflow vulnerability in Microsoft DNS Server. The flaw allows an unauthorized attacker to execute arbitrary code over a network without authentication or user interaction. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) update guide. The vulnerability is tracked under CWE-122 and affects DNS server components reachable over the network.

The Exploit Prediction Scoring System (EPSS) reports a probability of 0.673% with a percentile ranking near 51, as of the October 14, 2026 scoring date. No public proof-of-concept exploit or confirmed in-the-wild activity has been reported at the time of publication.

Critical Impact
Unauthenticated remote code execution against Microsoft DNS Server, potentially granting SYSTEM-level control over a core network infrastructure service.

Affected Products

Microsoft DNS Server (per the Microsoft Security Response Center advisory)
Specific Windows Server versions are enumerated in the Microsoft CVE-2026-96113 Update Guide

Discovery Timeline

2026-10-13 - CVE-2026-96113 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database
2026-10-14 - EPSS scoring published

Technical Details for CVE-2026-96113

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in Microsoft DNS Server. A remote, unauthenticated attacker can trigger the overflow by sending crafted DNS protocol traffic to a vulnerable server. Successful exploitation corrupts heap memory and permits arbitrary code execution in the context of the DNS service.

DNS Server typically runs with high privileges on Windows Server, often on domain controllers. Code execution in that context can lead to full host compromise and lateral movement across the Active Directory environment. Because DNS is required infrastructure, exposed servers cannot simply be taken offline without operational impact.

Root Cause

The root cause is improper validation of the size or structure of attacker-controlled DNS data before writing it into a heap-allocated buffer. When the service parses the malformed message, the write exceeds the destination buffer boundary. This corrupts adjacent heap metadata or object pointers, which an attacker can leverage to redirect execution. Microsoft has not published implementation details beyond the MSRC advisory.

Attack Vector

The attack vector is network-based. An attacker sends a specially crafted DNS request or response to a vulnerable DNS Server endpoint. No authentication, privileges, or user interaction are required. Internet-exposed DNS servers face direct risk; internal DNS infrastructure is reachable from any compromised host on the network.

No verified public exploit code is available. Refer to the Microsoft CVE-2026-96113 Update Guide for authoritative technical details.

Detection Methods for CVE-2026-96113

Indicators of Compromise

Unexpected crashes or restarts of the DNS service (dns.exe) on Windows Server hosts
Anomalous outbound connections initiated by the DNS service process to attacker-controlled infrastructure
Creation of new child processes by dns.exe, which is not expected during normal operation
DNS query or response packets with malformed, oversized, or atypical record structures logged by network sensors

Detection Strategies

Monitor Windows Event Log for DNS service faults, application crashes, and Windows Error Reporting entries referencing dns.exe
Deploy intrusion detection signatures targeting malformed DNS messages that exceed protocol-expected field lengths
Baseline normal DNS process behavior and alert on deviations such as child process creation, memory region allocation changes, or new network sockets

Monitoring Recommendations

Enable DNS debug logging and forward DNS server telemetry to a centralized analytics platform for correlation
Capture packet metadata at DNS server perimeters to retain forensic evidence of the triggering request
Alert on DNS servers initiating outbound traffic on non-DNS ports, which indicates post-exploitation activity

How to Mitigate CVE-2026-96113

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory on all Windows Server systems running the DNS Server role
Inventory all internal and external DNS servers and prioritize patching of internet-exposed and domain controller instances
Restrict inbound DNS traffic at the network perimeter to only trusted sources where feasible
Validate backup and recovery procedures for DNS infrastructure before applying updates

Patch Information

Microsoft has issued a security update addressed in the Microsoft CVE-2026-96113 Update Guide. Administrators should consult the guide for the specific Knowledge Base articles and build numbers corresponding to each supported Windows Server release, then deploy through Windows Update, Windows Server Update Services (WSUS), or Microsoft Endpoint Configuration Manager.

Workarounds

Limit exposure of DNS Server UDP/TCP port 53 to trusted networks using host-based and perimeter firewalls
Enable DNS response rate limiting and strict input validation features where supported
Isolate DNS servers in segmented network zones to reduce lateral movement opportunities if exploitation occurs
Monitor the DNS service for abnormal termination and configure automated restart with alerting until patches are applied

bash

# Example: restrict inbound DNS to trusted subnets using Windows Firewall (PowerShell)
New-NetFirewallRule -DisplayName "DNS-Allow-Trusted" `
  -Direction Inbound -Protocol UDP -LocalPort 53 `
  -RemoteAddress 10.0.0.0/8,192.168.0.0/16 -Action Allow

New-NetFirewallRule -DisplayName "DNS-Block-Other" `
  -Direction Inbound -Protocol UDP -LocalPort 53 `
  -Action Block