---
id: "CVE-2026-81384"
page: "https://infrastack.ai/live/CVE-2026-81384"
kind: "vulnerability"
aliases: ["CVE-2026-81384"]
title: "Windows DNS Server: heap overflow lets an unauthenticated network attacker run code"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["active-directory", "dns-server", "infrastructure", "windows"]
not_affected_if: ["no-dns-server-role"]
published_at: "2026-11-10T19:21:23+00:00"
first_seen_at: "2026-11-10T19:25:17+00:00"
updated_at: "2026-11-10T21:12:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81384", "first_seen_at": "2026-11-10T19:25:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T21:12:33+00:00"}]
exploit_sources: []
---

# Windows DNS Server: heap overflow lets an unauthenticated network attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-81384 (this .md is for agents)

A heap-based buffer overflow in the Microsoft DNS Server lets an unauthenticated attacker send crafted traffic over the network. The sources say this allows arbitrary code execution on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the DNS Server role is installed: run 'Get-WindowsFeature DNS' in PowerShell on each Windows Server. If it is not installed, you are not exposed. Then compare the build with the November 2026 Microsoft security update for your Windows Server version; the exact fixed build is unknown until the MSRC entry is read.

## Timeline

- 2026-11-10T19:25:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-81384
- 2026-11-10T21:12:33+00:00 analyst — Could not read the MSRC or NVD page (empty fetches). No affected versions, KB or fix found. Third-party aggregator NextGuard labels it use-after-free, while NVD says heap overflow; unresolved. Nothing verified. Needs the MSRC entry for builds and KBs.

## From the sources

Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_