{"id":"CVE-2026-96002","kind":"vulnerability","aliases":["CVE-2026-96002"],"related":[],"title":"Microsoft DNS Server: heap overflow lets an authorized user run code","description":"Heap-based buffer overflow in DNS Server allows an authorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft's DNS Server lets an attacker who already holds authorized access run code over the network. The sources do not name the affected versions or the exact trigger.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":"10.0.14393.0 to < 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":"10.0.17763.0 to < 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"10.0.20348.0 to < 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"10.0.26100.0 to < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dns-server","infrastructure","title-review","windows","windows-server"],"not_affected_if":["no-dns-server-role"],"how_to_check":"On each Windows Server, check whether the DNS Server role is installed (Get-WindowsFeature DNS) and the build number (winver or [System.Environment]::OSVersion). Vulnerable if the build is below: 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33822 (NVD, from Microsoft). Confirm the KB on the MSRC page.","fix":"Install the November 2026 Windows security update that raises the build to at least 10.0.14393.9688 (2016), 10.0.17763.9487 (2019), 10.0.20348.5870 (2022) or 10.0.26100.33822 (2025). KB numbers not read; see the MSRC page.","status":"open","published_at":"2026-11-10T19:21:56+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","triaged_at":"2026-11-10T19:25:54+00:00","updated_at":"2026-11-10T20:11:14+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:25:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft DNS Server: heap overflow lets an authorized user run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft's DNS Server lets an attacker who already holds authorized access run code over the network. The sources do not name the affected versions or the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","dns-server"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs code on the DNS server over the network","analyst_note":"Confirm affected Windows Server versions and whether a Microsoft security update fixes this CVE, using the NVD entry and Microsoft's advisory.","how_to_check":"- unknown","plain_action":"","product_name":"DNS Server","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":4482,"output_tokens":381,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows Server versions and whether a Microsoft security update fixes this CVE, using the NVD entry and Microsoft's advisory.","search":"'-2026':13A,16A '-96002':14A,17A '2016':20A '2019':23A '2022':26A '2025':29A 'access':59B 'affect':71B 'allow':85C 'alreadi':56B 'attack':54B,88C 'author':8A,58B,87C 'base':44B,79C 'buffer':45B,80C 'code':11A,61B,91C 'cve':12A,15A 'dns':2A,31B,50B,83C 'dns-server':30B 'exact':75B 'execut':90C 'heap':4A,43B,78C 'heap-bas':42B,77C 'hold':57B 'infrastructur':33B 'let':6A,52B 'microsoft':1A,48B 'name':69B 'network':64B,94C 'overflow':5A,46B,81C 'review':36B 'run':10A,60B 'server':3A,19A,22A,25A,28A,32B,40B,51B,84C 'sourc':66B 'titl':35B 'title-review':34B 'trigger':76B 'user':9A 'version':72B 'window':37B,39B 'windows':18A,21A,24A,27A 'windows-serv':38B","nicknames":[],"mitigations":[],"who_affected":"Windows Server machines running the DNS Server role (including domain controllers that host DNS) on 2016, 2019, 2022 and 2025, including Server Core. An attacker needs low-privilege authorized access and network reach to the DNS service. Servers without the DNS Server role can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["server2016","server2019","server2022","server2025","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["2016","2019","2022","2025","server","windows"],"labels":["dnsserver","high","infrastructure","titlereview","vendor","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96002':14A,17A '2016':20A '2019':23A '2022':26A '2025':29A 'author':8A 'code':11A 'cve':12A,15A 'dns':2A 'heap':4A 'let':6A 'microsoft':1A 'overflow':5A 'run':10A 'server':3A,19A,22A,25A,28A 'user':9A 'windows':18A,21A,24A,27A","search_b":"'access':59B 'affect':71B 'alreadi':56B 'attack':54B 'author':58B 'base':44B 'buffer':45B 'code':61B 'dns':31B,50B 'dns-server':30B 'exact':75B 'heap':43B 'heap-bas':42B 'hold':57B 'infrastructur':33B 'let':52B 'microsoft':48B 'name':69B 'network':64B 'overflow':46B 'review':36B 'run':60B 'server':32B,40B,51B 'sourc':66B 'titl':35B 'title-review':34B 'trigger':76B 'version':72B 'window':37B,39B 'windows-serv':38B","search_c":"'allow':85C 'attack':88C 'author':87C 'base':79C 'buffer':80C 'code':91C 'dns':83C 'execut':90C 'heap':78C 'heap-bas':77C 'network':94C 'overflow':81C 'server':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96002","severity":null,"published_at":"2026-11-10T19:21:56+00:00","modified_at":"2026-11-10T19:21:56+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","fetched_at":"2026-11-10T19:25:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96002:2620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96002","severity":null,"published_at":"2026-11-10T20:11:14+00:00","modified_at":"2026-11-10T20:11:14+00:00","first_seen_at":"2026-11-10T20:11:14+00:00","fetched_at":"2026-11-10T20:11:14+00:00","note":"NVD (Microsoft CNA data) lists affected builds; MSRC page is JS-only and unreadable, so no KB/fix page read and nothing verified. Likely sibling of CVE-2026-96113 (Oct, unauthenticated) but a distinct CVE needing PR:L.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-96002"]}],"documents":[{"id":117801,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96002","title":"NVD CVE-2026-96002 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}