CVE-2026-88218

Published Nov 10, 2026

Last updated a day ago

CVSS critical 9.8
Dns

Overview

Description
Double free in Windows DNS allows an unauthorized attacker to execute code over a network.
Source
secure@microsoft.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

secure@microsoft.com
CWE-415

Social media

Hype score
Not currently trending

  1. 🚨 CRITICAL — Nov Patch Tuesday: 5× CVSS 9.8Kerberos auth bypass CVE-2026-85844DNS RCE CVE-2026-88218LDAP RCE CVE-2026-119958SQL Server RCE CVE-2026-116945Windows Search RCE CVE-2026-116928All unauthenticated (AV:N/PR:N). Patch now.#CVE #PatchTuesday #Windows

    @ICHI_Global

    11 Nov 2026

    4 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  2. Windows DNSにCVSS 9.8の遠隔コード実行脆弱性CVE-2026-88218。認証不要、11月更新で修正 https://t.co/OQsRO69tFF 【Windows DNS脆弱性 CVE-2026-88218】 CVSS基本値：9.8（認証不要・複雑度低） 原因：二重解放（CWE-415） 影響：任意

    @joho_no_todai

    11 Nov 2026

    2881 Impressions

    3 Retweets

    14 Likes

    3 Bookmarks

    0 Replies

    1 Quote

Related CVEs

  1. CVE-2026-6949
  2. Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.•CVE-2026-94300
  3. NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.•CVE-2026-97206
  4. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.•CVE-2026-97839
  5. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.•CVE-2026-97837

References

Sources include official advisories and independent security research.