---
id: "CVE-2026-112727"
page: "https://infrastack.ai/live/CVE-2026-112727"
kind: "vulnerability"
aliases: ["CVE-2026-112727"]
title: "Windows DNS Server: untrusted pointer dereference allows remote code execution"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "DNS Server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33650"], "affected": "< 10.0.26100.33650", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5761"], "affected": "< 10.0.20348.5761", "ecosystem": "vendor"}, {"name": "Windows Server 2019", "fixed": ["10.0.17763.9376"], "affected": "< 10.0.17763.9376", "ecosystem": "vendor"}, {"name": "Windows Server 2016", "fixed": ["10.0.14393.9612"], "affected": "< 10.0.14393.9612", "ecosystem": "vendor"}, {"name": "Windows Server 2012 R2", "fixed": ["6.3.9600.23470"], "affected": "< 6.3.9600.23470", "ecosystem": "vendor"}, {"name": "Windows Server 2012", "fixed": ["6.2.9200.26434"], "affected": "< 6.2.9200.26434", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dns-server", "microsoft", "other", "rce", "windows"]
not_affected_if: ["dns-role-not-installed"]
published_at: "2026-11-10T19:18:31+00:00"
first_seen_at: "2026-11-10T19:24:30+00:00"
updated_at: "2026-11-11T00:20:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112727", "first_seen_at": "2026-11-10T19:24:30+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112727", "first_seen_at": "2026-11-11T00:20:13+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-112727"]}]
exploit_sources: []
---

# Windows DNS Server: untrusted pointer dereference allows remote code execution

Link for people: https://infrastack.ai/live/CVE-2026-112727 (this .md is for agents)

Microsoft (CNA) lists an untrusted pointer dereference (CWE-822) in the Windows DNS Server that lets an unauthorized attacker execute code over the network. CVSS 8.8 with user interaction required. No exploitation or PoC is recorded. The MSRC page could not be read (JavaScript only), so fixed builds come from the NVD copy of Microsoft's data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DNS Server affected range not listed fixed no fixed version listed
- vendor:Windows Server 2025 affected < 10.0.26100.33650 fixed 10.0.26100.33650
- vendor:Windows Server 2022 affected < 10.0.20348.5761 fixed 10.0.20348.5761
- vendor:Windows Server 2019 affected < 10.0.17763.9376 fixed 10.0.17763.9376
- vendor:Windows Server 2016 affected < 10.0.14393.9612 fixed 10.0.14393.9612
- vendor:Windows Server 2012 R2 affected < 6.3.9600.23470 fixed 6.3.9600.23470
- vendor:Windows Server 2012 affected < 6.2.9200.26434 fixed 6.2.9200.26434

## How to check

Only matters if the DNS Server role is installed (Get-WindowsFeature DNS; Get-Service DNS). Then compare the OS build (winver, or [System.Environment]::OSVersion) with the fixed builds listed, e.g. Server 2022 needs 10.0.20348.5761 or later, Server 2025 10.0.26100.33650 or later.

## Fix

Install the November 2026 Windows cumulative update. Fixed builds: Server 2025 10.0.26100.33650; Server 2022 10.0.20348.5761; Server 2019 10.0.17763.9376; Server 2016 10.0.14393.9612; Server 2012 R2 6.3.9600.23470; Server 2012 6.2.9200.26434.

## Timeline

- 2026-11-10T19:24:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112727
- 2026-11-11T00:20:13+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-112727 — Vendor is Microsoft (Windows DNS Server). Affected/fixed builds from NVD's copy of the Microsoft CNA data; MSRC page unreadable, so nothing marked verified. Windows 10/11 client builds also listed by NVD, not added as products. Tier B.

## Documents

- [advisory] NVD CVE-2026-112727 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/CVE-2026-112727

## From the sources

Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_