CVE-2026-72987 – Windows DNS Remote Code Execution Vulnerability

CVE-2026-72987 is a critical use-after-free vulnerability (CWE-416) in Windows DNS. An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires high attack complexity and specific conditions, but successful exploitation could have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: The vulnerability presents a network-based remote code execution threat. An attacker requires no privileges and no user interaction. Successful exploitation is not guaranteed because attack complexity is high and requires manipulation of system components to trigger a specific condition.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and the exploitability assessment is Exploitation Unlikely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free condition in Windows DNS. An unauthenticated remote attacker could send a specially crafted packet to an affected service over the network, triggering the memory-management flaw. Successful exploitation could result in remote code execution on the target system. The attack requires no privileges or user interaction, although its high attack complexity means an attacker needs detailed knowledge of the system and must trigger specific conditions. A successful attack could cause high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607 and 1809, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable 32-bit/x64 Windows 10 editions. Exploitation can occur remotely through a specially crafted network packet without authentication.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution, creating serious risks to affected Windows systems. Because confidentiality, integrity, and availability impacts are all rated High, compromise could expose sensitive information, enable unauthorized changes, and disrupt system availability. Systems providing DNS-related services may therefore represent significant organizational risk if left unpatched.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so affected systems should be updated with the applicable security update.

URGENCY: This vulnerability is rated Critical and allows potential remote code execution without authentication or user interaction. Although exploitation is assessed as unlikely and no exploitation is currently identified, the potentially severe confidentiality, integrity, and availability consequences make prompt deployment of the applicable security update important.