---
id: "CVE-2026-96002"
page: "https://infrastack.ai/live/CVE-2026-96002"
kind: "vulnerability"
aliases: ["CVE-2026-96002"]
title: "Microsoft DNS Server: heap overflow lets an authorized user run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Server 2016", "fixed": ["10.0.14393.9688"], "affected": "10.0.14393.0 to < 10.0.14393.9688", "ecosystem": "vendor"}, {"name": "Windows Server 2019", "fixed": ["10.0.17763.9487"], "affected": "10.0.17763.0 to < 10.0.17763.9487", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": "10.0.20348.0 to < 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": "10.0.26100.0 to < 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dns-server", "infrastructure", "title-review", "windows", "windows-server"]
not_affected_if: ["no-dns-server-role"]
published_at: "2026-11-10T19:21:56+00:00"
first_seen_at: "2026-11-10T19:25:26+00:00"
updated_at: "2026-11-10T20:11:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96002", "first_seen_at": "2026-11-10T19:25:26+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96002", "first_seen_at": "2026-11-10T20:11:14+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-96002"]}]
exploit_sources: []
---

# Microsoft DNS Server: heap overflow lets an authorized user run code

Link for people: https://infrastack.ai/live/CVE-2026-96002 (this .md is for agents)

A heap-based buffer overflow in Microsoft's DNS Server lets an attacker who already holds authorized access run code over the network. The sources do not name the affected versions or the exact trigger.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Server 2016 affected 10.0.14393.0 to < 10.0.14393.9688 fixed 10.0.14393.9688
- vendor:Windows Server 2019 affected 10.0.17763.0 to < 10.0.17763.9487 fixed 10.0.17763.9487
- vendor:Windows Server 2022 affected 10.0.20348.0 to < 10.0.20348.5870 fixed 10.0.20348.5870
- vendor:Windows Server 2025 affected 10.0.26100.0 to < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

On each Windows Server, check whether the DNS Server role is installed (Get-WindowsFeature DNS) and the build number (winver or [System.Environment]::OSVersion). Vulnerable if the build is below: 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33822 (NVD, from Microsoft). Confirm the KB on the MSRC page.

## Fix

Install the November 2026 Windows security update that raises the build to at least 10.0.14393.9688 (2016), 10.0.17763.9487 (2019), 10.0.20348.5870 (2022) or 10.0.26100.33822 (2025). KB numbers not read; see the MSRC page.

## Timeline

- 2026-11-10T19:25:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96002
- 2026-11-10T20:11:14+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-96002 — NVD (Microsoft CNA data) lists affected builds; MSRC page is JS-only and unreadable, so no KB/fix page read and nothing verified. Likely sibling of CVE-2026-96113 (Oct, unauthenticated) but a distinct CVE needing PR:L.

## Documents

- [describes] NVD CVE-2026-96002 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/CVE-2026-96002

## From the sources

Heap-based buffer overflow in DNS Server allows an authorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_