CVE Intelligence
Analysis AI-assisted

CVE-2026-41096: Microsoft Windows DNS Client Heap Overflow Leading to RCE

CVE-2026-41096 is a heap-based buffer overflow in the Microsoft Windows DNS Client that, according to the record, lets an unauthorized attacker execute code over a network. Microsoft's CNA scores it 9.8 (Critical) under CVSS 3.1, and the record lists it as not present in CISA KEV. Affected Windows 11 and Windows Server builds are listed with version ranges, and administrators should apply the vendor update.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-41096 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows DNS Client. The record describes it as allowing an unauthorized attacker to execute code over a network. The vendor advisory is the primary reference listed for remediation.

Impact

  • The record assigns CVSS 3.1 score 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low complexity, no privileges and no user interaction required, with high confidentiality, integrity and availability impact.
  • SSVC data in the record marks the issue as automatable (yes) with total technical impact.
  • Code execution is the impact described in the record; the sources consulted do not detail the exact execution context or the conditions needed to trigger the flaw.

Affected products and versions

The record lists the following Windows products with version ranges:

  • Windows 11 23H2 (listed bounds include before 10.0.22631.7079 and before 10.0.22631.7219)
  • Windows 11 24H2 (before 10.0.26100.8457 in one entry, and before 10.0.26100.8390 in another)
  • Windows 11 25H2 (before 10.0.26200.8457 in one entry, and before 10.0.26200.8390 in another)
  • Windows 11 26H1 (before 10.0.28000.2113)
  • Windows Server 2022 23H2, including the Server Core installation (before 10.0.25398.2330)
  • Windows Server 2025, including the Server Core installation (before 10.0.26100.32860, and before 10.0.26100.32772 in one entry)

Some entries for the same product list different upper bounds, so the exact fixed build for each edition should be confirmed in the Microsoft Security Update Guide.

Exploitation status

  • CISA KEV lists this CVE as not listed in the record, so no confirmed active exploitation is recorded there.
  • No confirmed exploitation appears in the sources consulted.
  • EPSS in the record is 0.00974 (percentile 0.61728), and SSVC exploitation is recorded as none. These are estimates and do not confirm exploitation.

Remediation and mitigation

  • Apply the Microsoft security update for the affected Windows edition and build as soon as possible, prioritizing internet-facing and critical systems and DNS-dependent services.
  • The record contains no explicit fixed-version list. The upper bounds in the affected ranges suggest the builds where the issue is resolved, but this is an inference and should be verified in the vendor advisory.
  • Where patching is delayed, restrict untrusted network paths to DNS client traffic and review DNS resolver configurations, following the organization's change process.

Detection guidance

  • Inventory Windows 11 and Windows Server hosts and compare build numbers against the ranges listed in the vendor advisory.
  • Monitor for unusual crashes or service restarts related to DNS client processes, and review endpoint telemetry for unexpected child processes or code execution activity on affected hosts.
  • Collect and retain DNS and network logs to support investigation if exploitation indicators appear.

Limitations of the available information

  • The record does not include a complete, unambiguous fixed-version list; the affected entries contain overlapping or duplicated product names and differing bounds.
  • No exploit details, proof-of-concept or detection signatures are present in the sources consulted.
  • The EPSS date in the record is later than the publication date, so the score should be treated as the value recorded at that time.
  • Exploitation status is limited to what the KEV listing and the other records show.

Frequently asked questions

What is CVE-2026-41096?

It is a heap-based buffer overflow in the Microsoft Windows DNS Client that, according to the record, allows an unauthorized network attacker to execute code.

Is CVE-2026-41096 known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Compare Windows builds with the affected ranges in Microsoft's advisory and apply the security update for each affected edition.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.