{"id":"CVE-2026-113855","kind":"vulnerability","aliases":["CVE-2026-113855"],"related":[],"title":"Windows DNS: uninitialized memory lets an attacker run code remotely","description":"Use of uninitialized resource in Windows DNS allows an unauthorized attacker to execute code over an adjacent network.","summary":"A flaw in the Windows DNS server leaves a resource uninitialized before use, so memory contents can be misused. An unauthorized attacker on the adjacent network could execute code.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"vendor"},{"name":"Windows Server 2025 (Server Core installation)","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["dns-server","infrastructure","self-hosted","windows","windows-server-2025"],"not_affected_if":["no-windows-dns-server","not-windows-server-2025","patched-build"],"how_to_check":"Only Windows Server 2025 (including Server Core) is listed. On each server run winver or [System.Environment]::OSVersion / (Get-ComputerInfo).OsVersion: affected if build is >= 10.0.26100.0 and < 10.0.26100.33822. Then check the DNS role: Get-WindowsFeature DNS (Installed) or Get-Service DNS. Also check other Windows Server versions against the MSRC page, which I could not read.","fix":"Install the November 2026 Windows Server 2025 cumulative update that brings the OS build to 10.0.26100.33822 or later (fixed build per Microsoft CNA data as relayed by NVD; KB number not read).","status":"open","published_at":"2026-11-10T19:19:06+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","triaged_at":"2026-11-10T19:45:03+00:00","updated_at":"2026-11-10T23:49:23+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:45:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DNS: uninitialized memory lets an attacker run code remotely","impact":"high","summary":"A flaw in the Windows DNS server leaves a resource uninitialized before use, so memory contents can be misused. An unauthorized attacker on the adjacent network could execute code.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","dns-server","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the DNS server over the adjacent network","analyst_note":"Check the Microsoft Security Update Guide entry for affected Windows builds, the DNS role requirement and the fixed patch, via the NVD link.","how_to_check":"- Confirm whether the host runs the DNS Server role on Windows (for example, check the DNS Server service in Services).\n- unknown for version-specific checks: the sources do not name affected builds.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-windows-dns-server"],"who_is_affected":"Windows machines acting as DNS servers are the systems to look at; the sources do not say which Windows builds or configurations are affected. Hosts that do not run the Windows DNS Server role are likely not exposed, but the sources do not confirm this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4494,"output_tokens":504,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for affected Windows builds, the DNS role requirement and the fixed patch, via the NVD link.","search":"'-113855':13A,16A '-2026':12A,15A '2025':19A,22A,37B 'adjac':62B,83C 'allow':74C 'attack':7A,59B,77C 'code':9A,66B,80C 'content':53B 'core':24A 'could':64B 'cve':11A,14A 'dns':2A,27B,43B,73C 'dns-server':26B 'execut':65B,79C 'flaw':39B 'host':32B 'infrastructur':29B 'installation':25A 'leav':45B 'let':5A 'memori':4A,52B 'misus':56B 'network':63B,84C 'remot':10A 'resourc':47B,70C 'run':8A 'self':31B 'self-host':30B 'server':18A,21A,23A,28B,36B,44B 'unauthor':58B,76C 'uniniti':3A,48B,69C 'use':50B,67C 'window':1A,33B,35B,42B,72C 'windows':17A,20A 'windows-serv':34B","nicknames":[],"mitigations":[],"who_affected":"Windows Server 2025 machines (full and Server Core) at a build below 10.0.26100.33822 that run the DNS Server role, per the Microsoft CNA data in NVD. An attacker needs to be on the adjacent network and the attack is rated high complexity. Servers without the DNS Server role, and other Windows versions not listed, can skip it until Microsoft says otherwise.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["server2025","server2025servercoreinstallation","windowsserver2025","windowsserver2025servercoreinstallation"],"ptokens":["2025","core","installation","server","windows"],"labels":["dnsserver","high","infrastructure","selfhosted","windows","windowsserver2025"],"campaign_type":null,"search_a":"'-113855':13A,16A '-2026':12A,15A '2025':19A,22A 'attack':7A 'code':9A 'core':24A 'cve':11A,14A 'dns':2A 'installation':25A 'let':5A 'memori':4A 'remot':10A 'run':8A 'server':18A,21A,23A 'uniniti':3A 'window':1A 'windows':17A,20A","search_b":"'2025':37B 'adjac':62B 'attack':59B 'code':66B 'content':53B 'could':64B 'dns':27B,43B 'dns-server':26B 'execut':65B 'flaw':39B 'host':32B 'infrastructur':29B 'leav':45B 'memori':52B 'misus':56B 'network':63B 'resourc':47B 'self':31B 'self-host':30B 'server':28B,36B,44B 'unauthor':58B 'uniniti':48B 'use':50B 'window':33B,35B,42B 'windows-serv':34B","search_c":"'adjac':83C 'allow':74C 'attack':77C 'code':80C 'dns':73C 'execut':79C 'network':84C 'resourc':70C 'unauthor':76C 'uniniti':69C 'use':67C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113855","severity":null,"published_at":"2026-11-10T19:19:06+00:00","modified_at":"2026-11-10T19:19:06+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","fetched_at":"2026-11-10T19:24:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113855:3237","url":"https://nvd.nist.gov/vuln/detail/cve-2026-113855","severity":null,"published_at":"2026-11-10T23:49:23+00:00","modified_at":"2026-11-10T23:49:23+00:00","first_seen_at":"2026-11-10T23:49:23+00:00","fetched_at":"2026-11-10T23:49:23+00:00","note":"Affected range and fixed build 10.0.26100.33822 from Microsoft CNA data on NVD (OffSeq agrees). MSRC page is JS-only and unreadable here (no browser credits), so nothing marked verified. No exploitation or PoC found (OffSeq: not in KEV, exploit maturity unproven). X/community search not done.","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-113855","https://radar.offseq.com/threat/cve-2026-113855-cwe-908-use-of-uninitialized-resource-in-microsoft-windows-server-2025-0743a28b12c60a28"]}],"documents":[{"id":120463,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-113855","title":"NVD: CVE-2026-113855 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120464,"url":"https://radar.offseq.com/threat/cve-2026-113855-cwe-908-use-of-uninitialized-resource-in-microsoft-windows-server-2025-0743a28b12c60a28","title":"OffSeq Threat Radar: CVE-2026-113855","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}