{"id":"CVE-2026-96064","kind":"vulnerability","aliases":["CVE-2026-96064"],"related":[],"title":"Windows DNS Server heap overflow lets an authenticated user run code over the network","description":"Heap-based buffer overflow in DNS Server allows an authorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft's DNS Server lets an attacker who already has authorized access send crafted input over the network. A successful attack lets them execute code on the server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":">= 10.0.20348.0, < 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["active-directory","dns","infrastructure","windows","windows-server"],"not_affected_if":["no-dns-role","no-dns-server-role","patched","third-party-dns-software"],"how_to_check":"On each Windows Server, check if the DNS Server role is installed (Get-WindowsFeature DNS). If so, check the build (winver, or [System.Environment]::OSVersion.Version) and compare with the fixed builds: 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33822. Lower means vulnerable. Check Server Core installs too.","fix":"Install the November 2026 Windows security update: Server 2016 build 10.0.14393.9688 or later, Server 2019 10.0.17763.9487 or later, Server 2022 10.0.20348.5870 or later, Server 2025 10.0.26100.33822 or later. KB numbers not confirmed.","status":"open","published_at":"2026-11-10T19:22:04+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","triaged_at":"2026-11-10T19:27:40+00:00","updated_at":"2026-11-10T19:57:12+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-10T19:27:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft DNS Server: heap overflow lets an authorized user run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft's DNS Server lets an attacker who already has authorized access send crafted input over the network. A successful attack lets them execute code on the server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-server","dns"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the DNS server over the network","analyst_note":"Confirm affected Windows Server builds and the fixed KB or build from the Microsoft Security Response Center advisory for CVE-2026-96064; the NVD entry gives no version data.","how_to_check":"- Check whether the host runs the DNS Server role (for example, `Get-WindowsFeature DNS` in PowerShell on Windows Server)\n- Compare the installed Windows build against the fixed build listed in Microsoft's advisory for CVE-2026-96064 (unknown from the sources given)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-dns-server-role","third-party-dns-software"],"who_is_affected":"Only servers running the Microsoft DNS Server role are relevant; hosts that only use DNS clients or third-party DNS software are not covered by this description. The sources do not state which Windows builds are fixed, and the attacker must first be authorized on the DNS service.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4482,"output_tokens":559,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows Server builds and the fixed KB or build from the Microsoft Security Response Center advisory for CVE-2026-96064; the NVD entry gives no version data.","search":"'-2026':16A,19A '-96064':17A,20A '2016':23A '2019':26A '2022':29A '2025':32A 'access':60B 'activ':34B 'active-directori':33B 'allow':85C 'alreadi':57B 'attack':55B,69B,88C 'authent':8A 'author':59B,87C 'base':45B,79C 'buffer':46B,80C 'code':11A,73B,91C 'craft':62B 'cve':15A,18A 'directori':35B 'dns':2A,36B,51B,83C 'execut':72B,90C 'heap':4A,44B,78C 'heap-bas':43B,77C 'infrastructur':37B 'input':63B 'let':6A,53B,70B 'microsoft':49B 'network':14A,66B,94C 'overflow':5A,47B,81C 'run':10A 'send':61B 'server':3A,22A,25A,28A,31A,41B,52B,76B,84C 'success':68B 'user':9A 'window':1A,38B,40B 'windows':21A,24A,27A,30A 'windows-serv':39B","nicknames":[],"mitigations":[],"who_affected":"Windows Servers running the DNS Server role (including Server Core) on Windows Server 2016, 2019, 2022 and 2025 below the fixed builds. The attacker needs a low-privilege authenticated account (CVSS PR:L) and network access to the DNS server. Servers without the DNS role can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T19:57:12Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-96064","run_id":2582},"products":{"at":"2026-11-10T19:57:12Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-96064","run_id":2582},"who_affected":{"at":"2026-11-10T19:57:12Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-96064","run_id":2582}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["server2016","server2019","server2022","server2025","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["2016","2019","2022","2025","server","windows"],"labels":["activedirectory","dns","high","infrastructure","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':16A,19A '-96064':17A,20A '2016':23A '2019':26A '2022':29A '2025':32A 'authent':8A 'code':11A 'cve':15A,18A 'dns':2A 'heap':4A 'let':6A 'network':14A 'overflow':5A 'run':10A 'server':3A,22A,25A,28A,31A 'user':9A 'window':1A 'windows':21A,24A,27A,30A","search_b":"'access':60B 'activ':34B 'active-directori':33B 'alreadi':57B 'attack':55B,69B 'author':59B 'base':45B 'buffer':46B 'code':73B 'craft':62B 'directori':35B 'dns':36B,51B 'execut':72B 'heap':44B 'heap-bas':43B 'infrastructur':37B 'input':63B 'let':53B,70B 'microsoft':49B 'network':66B 'overflow':47B 'send':61B 'server':41B,52B,76B 'success':68B 'window':38B,40B 'windows-serv':39B","search_c":"'allow':85C 'attack':88C 'author':87C 'base':79C 'buffer':80C 'code':91C 'dns':83C 'execut':90C 'heap':78C 'heap-bas':77C 'network':94C 'overflow':81C 'server':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96064","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96064","severity":null,"published_at":"2026-11-10T19:22:04+00:00","modified_at":"2026-11-10T19:22:04+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","fetched_at":"2026-11-10T19:25:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96064:2582","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96064","severity":null,"published_at":"2026-11-10T19:57:12+00:00","modified_at":"2026-11-10T19:57:12+00:00","first_seen_at":"2026-11-10T19:57:12+00:00","fetched_at":"2026-11-10T19:57:12+00:00","note":"Read Microsoft's CNA CVE record (MSRC page is JS-only, not read directly): affected/fixed builds for Server 2016/2019/2022/2025. No KB numbers, no exploitation or PoC info found; sibling CVE-2026-96113 is a different unauthenticated bug.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-96064"]}],"documents":[{"id":117720,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-96064","title":"CVE-2026-96064 CVE record published by Microsoft (CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}