{"id":"CVE-2026-81384","kind":"vulnerability","aliases":["CVE-2026-81384"],"related":[],"title":"Windows DNS Server: heap overflow lets an unauthenticated network attacker run code","description":"Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in the Microsoft DNS Server lets an unauthenticated attacker send crafted traffic over the network. The sources say this allows arbitrary code execution on the server.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["active-directory","dns-server","infrastructure","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:23+00:00","first_seen_at":"2026-11-10T19:25:17+00:00","triaged_at":"2026-11-10T19:34:34+00:00","updated_at":"2026-11-10T19:34:34+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:34:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DNS Server: heap overflow lets an unauthenticated network attacker run code","impact":"high","summary":"A heap-based buffer overflow in the Microsoft DNS Server lets an unauthenticated attacker send crafted traffic over the network. The sources say this allows arbitrary code execution on the server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","dns-server","active-directory"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the DNS server over the network","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-81384 for affected versions, the patch, and whether the DNS Server role is required to be exposed.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running the Microsoft DNS Server role on Windows Server are the exposed systems. The sources do not say which versions or configurations are affected, so unknown beyond the DNS Server component. Systems that do not run a DNS Server role are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4486,"output_tokens":452,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-81384 for affected versions, the patch, and whether the DNS Server role is required to be exposed.","search":"'-2026':14A,17A '-81384':15A,18A 'activ':20B 'active-directori':19B 'allow':52B,67C 'arbitrari':53B 'attack':10A,41B,70C 'base':30B,61C 'buffer':31B,62C 'code':12A,54B,73C 'craft':43B 'cve':13A,16A 'directori':21B 'dns':2A,23B,36B,65C 'dns-server':22B 'execut':55B,72C 'heap':4A,29B,60C 'heap-bas':28B,59C 'infrastructur':25B 'let':6A,38B 'microsoft':35B 'network':9A,47B,76C 'overflow':5A,32B,63C 'run':11A 'say':50B 'send':42B 'server':3A,24B,37B,58B,66C 'sourc':49B 'traffic':44B 'unauthent':8A,40B 'unauthor':69C 'window':1A,26B","nicknames":[],"mitigations":[],"who_affected":"Organizations running the Microsoft DNS Server role on Windows Server are the exposed systems. The sources do not say which versions or configurations are affected, so unknown beyond the DNS Server component. Systems that do not run a DNS Server role are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["activedirectory","dnsserver","high","infrastructure","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-81384':15A,18A 'attack':10A 'code':12A 'cve':13A,16A 'dns':2A 'heap':4A 'let':6A 'network':9A 'overflow':5A 'run':11A 'server':3A 'unauthent':8A 'window':1A","search_b":"'activ':20B 'active-directori':19B 'allow':52B 'arbitrari':53B 'attack':41B 'base':30B 'buffer':31B 'code':54B 'craft':43B 'directori':21B 'dns':23B,36B 'dns-server':22B 'execut':55B 'heap':29B 'heap-bas':28B 'infrastructur':25B 'let':38B 'microsoft':35B 'network':47B 'overflow':32B 'say':50B 'send':42B 'server':24B,37B,58B 'sourc':49B 'traffic':44B 'unauthent':40B 'window':26B","search_c":"'allow':67C 'attack':70C 'base':61C 'buffer':62C 'code':73C 'dns':65C 'execut':72C 'heap':60C 'heap-bas':59C 'network':76C 'overflow':63C 'server':66C 'unauthor':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81384","severity":null,"published_at":"2026-11-10T19:21:23+00:00","modified_at":"2026-11-10T19:21:23+00:00","first_seen_at":"2026-11-10T19:25:17+00:00","fetched_at":"2026-11-10T19:25:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}