CVE-2026-41096

Published May 12, 2026

Last updated a month ago

CVSS critical 9.8

Dns

Overview

Description: Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.
Source: secure@microsoft.com
NVD status: Analyzed
Products: windows_11_23h2, windows_11_24h2, windows_11_25h2, windows_11_26h1, windows_server_2022_23h2, windows_server_2025

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

secure@microsoft.com: CWE-122

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "D039A905-2FE4-4A10-85BF-175947E6A017",
            "versionEndExcluding": "10.0.22631.7079",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "4904DDBD-B183-4AA2-ABD6-47BAF1A28861",
            "versionEndExcluding": "10.0.22631.7079",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "048AD3CD-DD62-4B62-9302-61779D998B4A",
            "versionEndExcluding": "10.0.26100.8390",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "3682F4DD-0870-4E39-B75E-649C89BB1E08",
            "versionEndExcluding": "10.0.26100.8390",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "C2C93D38-DFD7-4DE1-95B8-6D73E4A545D6",
            "versionEndExcluding": "10.0.26200.8390",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "05EB89A0-2ADD-4B67-A644-41FE1DE69E4A",
            "versionEndExcluding": "10.0.26200.8390",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "D45A5D2F-E058-4033-B184-BAE224FC1CEA",
            "versionEndExcluding": "10.0.28000.2113",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "5127F350-9271-4B74-84E0-D7E5D2D5640E",
            "versionEndExcluding": "10.0.28000.2113",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E3F26150-16EA-4D34-8BE9-2EE7C745D707",
            "versionEndExcluding": "10.0.25398.2330",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "9ABAB3B9-28AF-4278-8E78-E1191B1AFC0C",
            "versionEndExcluding": "10.0.26100.32772",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References