Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation requires the affected DNS server to use a specific non-default server plug-in and configuration that are not present in a default installation.
How could an attacker exploit this vulnerability?
An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to have a deep understanding of the system. Successful exploitation is not guaranteed and depends on a combination of factors that might include the environment, system configuration, and the presence of additional security measures.
Security updates
10.0.20348.5870 — https://support.microsoft.com/help/5131090
10.0.26100.33822 — https://support.microsoft.com/help/5131080
10.0.26100.33730 — https://support.microsoft.com/help/5131077
Vulnerabilities 1
-
High 8.1
Windows DNS Server Remote Code Execution Vulnerability
Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-81384 Windows DNS Server Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81384
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss