CVE-2026-41096

Published May 12, 2026

Last updated 2 months ago

Dns

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-41096 is identified as a heap-based buffer overflow vulnerability residing within the Microsoft Windows DNS client, specifically affecting the `dnsapi.dll` component. This flaw can be triggered when the Windows DNS client improperly processes specially crafted DNS responses. An unauthenticated remote attacker can exploit this vulnerability by sending malicious DNS traffic to a vulnerable system, requiring no user interaction. Successful exploitation allows for arbitrary code execution in the context of the DNS service, which typically operates with elevated privileges. The vulnerability impacts Windows 11 client builds 23H2 through 26H1, Windows Server 2022 23H2, and Windows Server 2025.

Description: Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.
Source: secure@microsoft.com
NVD status: Analyzed
Products: windows_11_23h2, windows_11_24h2, windows_11_25h2, windows_11_26h1, windows_server_2022_23h2, windows_server_2025

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

secure@microsoft.com: CWE-122

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "D039A905-2FE4-4A10-85BF-175947E6A017",
            "versionEndExcluding": "10.0.22631.7079",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "4904DDBD-B183-4AA2-ABD6-47BAF1A28861",
            "versionEndExcluding": "10.0.22631.7079",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "048AD3CD-DD62-4B62-9302-61779D998B4A",
            "versionEndExcluding": "10.0.26100.8390",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "3682F4DD-0870-4E39-B75E-649C89BB1E08",
            "versionEndExcluding": "10.0.26100.8390",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "C2C93D38-DFD7-4DE1-95B8-6D73E4A545D6",
            "versionEndExcluding": "10.0.26200.8390",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "05EB89A0-2ADD-4B67-A644-41FE1DE69E4A",
            "versionEndExcluding": "10.0.26200.8390",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "D45A5D2F-E058-4033-B184-BAE224FC1CEA",
            "versionEndExcluding": "10.0.28000.2113",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "5127F350-9271-4B74-84E0-D7E5D2D5640E",
            "versionEndExcluding": "10.0.28000.2113",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E3F26150-16EA-4D34-8BE9-2EE7C745D707",
            "versionEndExcluding": "10.0.25398.2330",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "9ABAB3B9-28AF-4278-8E78-E1191B1AFC0C",
            "versionEndExcluding": "10.0.26100.32772",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.