CVE-2026-77505 – Windows DNS Server Remote Code Execution Vulnerability

CVE-2026-77505 is a critical use-after-free vulnerability in Windows DNS Server. An unauthenticated attacker with network access could send specially timed DNS queries to a DNS server configured with a server-level DNS plug-in and attempt to trigger a race condition. Successful exploitation could result in remote code execution with SYSTEM privileges. The vulnerability is not publicly disclosed and is not currently reported as exploited.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: The vulnerability presents a remote code execution threat to affected Windows systems running the relevant DNS Server configuration. An attacker does not require authentication, privileges, or user interaction. Exploitation has high complexity because the attacker must successfully win a timing-dependent race condition. A successful attack could compromise confidentiality, integrity, and availability.

EXPLOITS: Exploitation is assessed as less likely. The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven; the existence of public exploit code, zero-day exploitation, or proof-of-concept code cannot be confirmed.

TECHNICAL SUMMARY: CVE-2026-77505 is caused by a use-after-free weakness (CWE-416) in Windows DNS Server. An unauthenticated attacker could send DNS queries over the network to a Windows DNS Server configured with a server-level DNS plug-in. By winning a timing-dependent race condition in the server’s record-handling logic, the attacker could cause the server to operate on memory after it has been freed. Successful exploitation could allow attacker-controlled code to execute with SYSTEM privileges. Attack complexity is rated High because exploitation depends on winning this race condition.

EXPLOITABILITY: Affected products include Windows 10 versions 1607 and 1809, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation requires network access but no privileges or user interaction. The target DNS Server must be configured with a server-level DNS plug-in.

BUSINESS IMPACT: Successful exploitation could give an attacker SYSTEM-level code execution on a vulnerable DNS server, creating serious confidentiality, integrity, and availability risks. Compromise of infrastructure providing DNS services could affect critical business operations and expose the affected server to unauthorized control. *“When a DNS server falls at SYSTEM privilege, a core infrastructure service can become a high-impact point of compromise.”*

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and the affected systems require a restart after installation.

URGENCY: This vulnerability is rated Critical and enables remote code execution with SYSTEM privileges if successfully exploited. Although exploitation is assessed as less likely and is not currently reported, affected DNS servers should be prioritized for deployment of the official fix because successful exploitation could result in a high-impact server compromise.