Microsoft warns of critical remote code execution flaw in Windows DNS Server

Microsoft has published an advisory regarding a critical security flaw in its Windows Domain Name Service infrastructure. The vulnerability, tracked as CVE-2026-96113, allows an unauthorized attacker to execute arbitrary code over a network by exploiting a heap-based buffer overflow within the DNS Server component.

The National Vulnerability Database lists the severity of CVE-2026-96113 as critical with a CVSS score of 9.8. The record cites weaknesses CWE-122 and CWE-197. The Microsoft Security Update Guide describes the issue specifically as a heap-based buffer overflow in the DNS Server that allows an unauthorized attacker to execute code over a network.

Technical context and classification

The advisory from Microsoft identifies the vulnerability as a heap-based buffer overflow in the DNS Server. The National Vulnerability Database record includes CWE-122 and CWE-197 as associated weaknesses. The description provided by Microsoft states that this flaw allows an unauthorized attacker to execute code over a network.

The source material does not detail the specific technical mechanism of the exploit beyond the classification of a heap-based buffer overflow. It does not specify how the overflow is triggered or what memory structures are affected. The description remains limited to the capability of an unauthorized attacker to execute code remotely via the DNS Server component.

Affected systems and scope

The advisory from Microsoft identifies the Windows Domain Name Service as the affected component. The vulnerability applies to the DNS Server role running on Windows platforms. Organizations relying on Windows-based DNS infrastructure are the primary targets for this specific threat.

The NVD record confirms the vulnerability exists in the DNS Server software but does not list specific affected versions in the provided text. Security professionals must assume that any Windows system running the DNS Server role is potentially vulnerable until specific version exclusions are confirmed by Microsoft. The remote nature of the exploit means that any system with the DNS service accessible from a network is at risk.

What should you do?

Security teams should immediately audit their network infrastructure to identify all systems running the Windows DNS Server role. Since the vulnerability allows remote code execution, exposed DNS servers should be restricted via firewall rules to limit access to trusted networks only. Organizations should monitor for unusual DNS traffic patterns that could indicate exploitation attempts.

What to do and how to stay safe: Microsoft

• Inventory all Windows servers running the DNS Server role to determine exposure scope.
• Restrict network access to DNS services using firewall rules to limit exposure to untrusted networks.
• Monitor DNS server logs for anomalous traffic or unexpected service restarts that may indicate exploitation.
• Prepare to apply patches immediately once the vendor provides an update for CVE-2026-96113.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-96113?

CVE-2026-96113 is a heap-based buffer overflow vulnerability in the Windows DNS Server that allows remote code execution.

How severe is this vulnerability?

The National Vulnerability Database rates CVE-2026-96113 as critical with a CVSS score of 9.8.

Who can exploit this flaw?

The advisory states that an unauthorized attacker can execute code over a network.