{"id":"CVE-2026-88218","kind":"vulnerability","aliases":["CVE-2026-88218"],"related":[],"title":"Windows DNS: double free lets unauthenticated network attacker run code","description":"Double free in Windows DNS allows an unauthorized attacker to execute code over a network.","summary":"A double free bug in the Windows DNS server lets an unauthorized attacker send crafted requests over the network. A successful attack can execute code on the affected server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-server","network-reachable","runtime","windows","windows-server"],"not_affected_if":[],"how_to_check":"Unconfirmed: on each Windows Server run 'Get-WindowsFeature DNS' (Installed = yes means the DNS Server role is present, and domain controllers often run it). Then compare the installed cumulative update against the November 2026 MSRC entry for CVE-2026-88218 once it lists KBs.","fix":null,"status":"open","published_at":"2026-11-10T19:21:28+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","triaged_at":"2026-11-10T19:25:36+00:00","updated_at":"2026-11-10T19:30:09+00:00","category":"runtime","confidence":0.3,"triage":{"at":"2026-11-10T19:25:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DNS: double free lets unauthenticated network attacker run code","impact":"high","summary":"A double free bug in the Windows DNS server lets an unauthorized attacker send crafted requests over the network. A successful attack can execute code on the affected server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["windows","dns-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows DNS server over the network","analyst_note":"Confirm affected Windows Server versions and whether the DNS Server role is required, and find the Microsoft advisory and patch for CVE-2026-88218.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000619,"input_tokens":4473,"output_tokens":343,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm affected Windows Server versions and whether the DNS Server role is required, and find the Microsoft advisory and patch for CVE-2026-88218.","search":"'-2026':12A,15A '-88218':13A,16A 'affect':55B 'allow':62C 'attack':8A,40B,49B,65C 'bug':31B 'code':10A,52B,68C 'craft':42B 'cve':11A,14A 'dns':2A,18B,35B,61C 'dns-server':17B 'doubl':3A,29B,57C 'execut':51B,67C 'free':4A,30B,58C 'let':5A,37B 'network':7A,21B,46B,71C 'network-reach':20B 'reachabl':22B 'request':43B 'run':9A 'runtim':23B 'send':41B 'server':19B,27B,36B,56B 'success':48B 'unauthent':6A 'unauthor':39B,64C 'window':1A,24B,26B,34B,60C 'windows-serv':25B","nicknames":[],"mitigations":[],"who_affected":"Windows Server machines running the DNS Server role are the likely target; the CVSS vector is network, no authentication, no user interaction. Affected versions and KBs are not yet confirmed from Microsoft's advisory. Machines without the DNS Server role are probably not exposed, but this is unconfirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","dnsserver","networkreachable","runtime","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':12A,15A '-88218':13A,16A 'attack':8A 'code':10A 'cve':11A,14A 'dns':2A 'doubl':3A 'free':4A 'let':5A 'network':7A 'run':9A 'unauthent':6A 'window':1A","search_b":"'affect':55B 'attack':40B,49B 'bug':31B 'code':52B 'craft':42B 'dns':18B,35B 'dns-server':17B 'doubl':29B 'execut':51B 'free':30B 'let':37B 'network':21B,46B 'network-reach':20B 'reachabl':22B 'request':43B 'runtim':23B 'send':41B 'server':19B,27B,36B,56B 'success':48B 'unauthor':39B 'window':24B,26B,34B 'windows-serv':25B","search_c":"'allow':62C 'attack':65C 'code':68C 'dns':61C 'doubl':57C 'execut':67C 'free':58C 'network':71C 'unauthor':64C 'window':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88218","severity":null,"published_at":"2026-11-10T19:21:28+00:00","modified_at":"2026-11-10T19:21:29+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","fetched_at":"2026-11-10T19:25:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-88218:2512","url":null,"severity":null,"published_at":"2026-11-10T19:30:09+00:00","modified_at":"2026-11-10T19:30:09+00:00","first_seen_at":"2026-11-10T19:30:09+00:00","fetched_at":"2026-11-10T19:30:09+00:00","note":"Patch Tuesday 2026-11-10 CVE; MSRC page is JS-only and the CVRF 2026-Nov feed is not up yet, so no Microsoft advisory, KB or affected-version list was readable. Searches found no write-ups or PoC (similar August DNS CVEs are different ids). Nothing verified. Revisit when MSRC publishes."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}