CVE-2026-70166: Windows DNS Denial of Service Vulnerability
Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network.
Other sources
Windows DNS Denial of Service Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.9600.23470Patch KB5126836 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.9612Patch KB5126868 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5761Patch KB5126655 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.9376Patch KB5126651 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33650Patch KB5126646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.9200.26434Patch KB5126835
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems running the listed Microsoft Windows versions are in scope where the Windows DNS component is reachable over the network. The affected products include Windows 10 and Windows Server 2012 through Windows Server 2025, including the listed R2 release.
What does an attacker need to exploit it?
The attacker needs authorized access, as reflected by the PR:L vector, and can exploit the issue over a network. No user interaction is required, and the attack complexity is low.
What is the expected impact?
Successful exploitation can deny service by triggering the out-of-bounds read in Windows DNS. The provided vector indicates no confidentiality or integrity impact.