CVE-2026-96113 – Windows Domain Name Service Remote Code Execution Vulnerability

CVE-2026-96113 is a Critical Remote Code Execution (RCE) vulnerability affecting Windows Domain Name Service (DNS). The vulnerability involves a heap-based buffer overflow and numeric truncation error, which could allow an attacker to execute malicious code on an affected system. Since DNS is essential for network communication and service availability, successful exploitation could potentially compromise critical Windows servers, disrupt business operations, and expose sensitive information. Microsoft has classified exploitation as less likely, and the vulnerability has not been publicly disclosed or reported as exploited.

CVSS SCORE: N/A (Base Score not available).

SEVERITY: Critical

Threat

This vulnerability presents a significant security risk because it affects Windows DNS functionality, which plays an important role in enterprise network infrastructure.

The vulnerability is associated with two security weaknesses:

• CWE-122 – Heap-based Buffer Overflow: Improper memory handling could allow an attacker to corrupt memory and potentially execute malicious code.
• CWE-197 – Numeric Truncation Error: Incorrect handling of numeric values could lead to unexpected behavior, potentially contributing to memory corruption.

Successful exploitation could allow an attacker to execute unauthorized code on a vulnerable system, potentially compromising server security and affecting connected business services.

The risk is particularly concerning for organizations running Windows DNS services on critical infrastructure, including domain controllers and enterprise servers.

Exploits

Microsoft has assessed exploitation of CVE-2026-96113 as Exploitation Less Likely.

The vulnerability has not been publicly disclosed and has not been reported as actively exploited.

There is no confirmed information about publicly available exploit code, proof-of-concept (PoC) exploits, or zero-day attacks targeting this vulnerability.

Although active exploitation has not been reported, the vulnerability’s Critical severity and potential for remote code execution make it an important security concern.

Technical Summary

CVE-2026-96113 is a Remote Code Execution vulnerability in Windows Domain Name Service associated with improper memory handling and numeric value conversion.

The vulnerability involves two underlying weaknesses:

1. Heap-based Buffer Overflow (CWE-122)

A heap-based buffer overflow occurs when an application writes data beyond the allocated memory boundaries of a buffer.

This type of weakness can cause memory corruption, application instability, or potentially allow an attacker to execute malicious code.

2. Numeric Truncation Error (CWE-197)

Numeric truncation occurs when a numeric value is converted into a smaller data type, potentially losing important information.

This can lead to incorrect calculations or memory allocation behavior, creating conditions that may contribute to memory corruption.

Potential Exploitation Impact:

If successfully exploited, this vulnerability could allow an attacker to execute unauthorized code on an affected Windows system.

Depending on the execution context, potential consequences include:

• Compromise of vulnerable Windows servers.
• Unauthorized execution of malicious programs.
• Disruption of DNS functionality and dependent network services.
• Potential access to sensitive systems or information.
• Further compromise of connected infrastructure.

The exact attack requirements, necessary privileges, user interaction requirements, and specific exploitation technique have not been confirmed.

Exploitability

Microsoft has classified exploitation as Less Likely.

The vulnerability affects the following Microsoft products:

Windows Server:

• Windows Server 2012 and 2012 R2
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025

Both standard and Server Core installations are affected.

Windows Client:

• Windows 10 Version 1607 (32-bit and x64)
• Windows 10 Version 1809 (32-bit and x64)

The affected Windows 10 products carry an Important severity rating, while the affected Windows Server products carry a Critical severity rating.

Successful exploitation could potentially result in remote code execution. However, the specific attack conditions and exploitation requirements have not been confirmed.

Business Impact

This vulnerability represents a serious concern for organizations relying on Windows DNS services to support business applications, authentication infrastructure, and network connectivity.

“When DNS infrastructure is compromised, the impact can reach far beyond one server, potentially disrupting the services an entire organization depends on.”

Successful exploitation could result in several business consequences:

• Server Compromise: Attackers could potentially execute malicious code on affected Windows servers, compromising critical infrastructure.
• Operational Disruption: Compromised DNS services could affect name resolution, application connectivity, and access to essential business systems.
• Security Exposure: Unauthorized code execution could create opportunities for additional malicious activity and potential exposure of sensitive information.
• Network-Wide Impact: Organizations using Windows DNS across multiple business locations or critical environments could experience broader operational consequences.
• Financial and Reputational Damage: Service interruptions, incident response activities, and potential security breaches could increase operational costs and affect customer confidence.

Because DNS services are fundamental to enterprise network operations, protecting vulnerable servers is important for maintaining business continuity and infrastructure security.

Workaround

Microsoft has not specified an official workaround or mitigation for this vulnerability.

If immediate patch deployment is not possible, organizations should consider the following temporary precautions:

• Restrict network access to DNS services where operationally feasible.
• Limit unnecessary exposure of affected servers to untrusted networks.
• Monitor DNS servers for suspicious activity and unexpected process behavior.
• Prioritize security monitoring for critical DNS infrastructure.

These precautions may reduce exposure but do not eliminate the underlying vulnerability.

Urgency

Critical Severity – Prioritize Patch Deployment

CVE-2026-96113 should be prioritized for remediation because it affects critical Windows Server infrastructure and carries the potential for remote code execution.

Although Microsoft currently considers exploitation less likely and has not reported active exploitation, the vulnerability involves memory corruption weaknesses that could have serious consequences if successfully exploited.

“An unpatched DNS server can become a critical security weakness. Fixing it early helps protect the systems and services that keep business running.”

Organizations should prioritize patching Windows servers supporting DNS and other business-critical services.

Recommended Security Updates:

• Windows Server 2012: KB5126835
• Windows Server 2012 R2: KB5126836
• Windows Server 2016: KB5126868
• Windows Server 2019: KB5126651
• Windows Server 2022: KB5126655
• Windows Server 2025: KB5126646
• Windows 10 Version 1607: KB5126868
• Windows 10 Version 1809: KB5126651

A system restart is required after installing the applicable security updates.

Security teams should schedule deployment according to business-critical priorities, validate successful installation, and confirm that affected systems have restarted.