CVE-2026-62878 – Windows DNS Server Remote Code Execution Vulnerability

CVE-2026-62878 is a Critical stack-based buffer overflow vulnerability in Windows DNS. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The attack has low complexity and requires neither privileges nor user interaction. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS Score: 9.8.

SEVERITY: Critical.

THREAT:
The vulnerability creates a network-based remote code execution threat against affected Windows systems running the vulnerable DNS service. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITS:
No exploitation is currently reported, and the vulnerability is not publicly disclosed. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY:
CVE-2026-62878 is caused by a stack-based buffer overflow (CWE-121) in Windows DNS. An unauthenticated attacker can target an affected service by sending a specially crafted network packet. The attack vector is network-based, attack complexity is low, privileges are not required, and no user interaction is needed. Successful exploitation could allow execution of code on the target system and result in high confidentiality, integrity, and availability impact.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation can occur remotely through a specially crafted packet sent to the affected service without authentication.

BUSINESS IMPACT:
Successful exploitation could allow an unauthorized remote attacker to execute code on an affected system. For organizations operating vulnerable Windows DNS services, this creates the potential for serious system compromise, disruption of critical services, unauthorized access to sensitive information, and loss of data integrity or availability.

WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making security update deployment the documented remediation.

URGENCY:
This Critical vulnerability has a CVSS base score of 9.8 and can be attacked remotely with low complexity, without privileges or user interaction. Although exploitation is currently assessed as Less Likely and no exploitation is reported, the potential for unauthenticated remote code execution makes timely patch deployment important.