CVE-2026-70119: Windows DNS Remote Code Execution Vulnerability
Out-of-bounds read in Windows DNS allows an authorized attacker to execute code over a network.
Other sources
Windows DNS Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33650Patch KB5126646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5761Patch KB5126655
Event History
Frequently Asked Questions
Which systems are identified as affected?
The listed affected products are Microsoft Windows Server 2025 and Microsoft Windows Server 2022.
What level of access does an attacker need?
The vulnerability is network-reachable and has low attack complexity, but exploitation requires low privileges. No user interaction is required.
What security impact is reflected in the supplied severity data?
The supplied vector indicates high availability impact, with no confidentiality or integrity impact listed. The description also states that an authorized attacker can execute code over the network.