Description
Use after free in Windows DNS allows an unauthorized attacker to deny service over a network.
Published: 2026-09-08
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a Use‑After‑Free flaw in the Windows DNS server that allows an attacker with network access to trigger a crash of the DNS service. When the service terminates as a result, network name resolution fails until the device is restarted, causing a denial of service for any application that relies on DNS within the affected system.

Affected Systems

Microsoft Windows 10 (Version 1607 and Version 1809) and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including core installations, are affected by the flaw.

Risk and Exploitability

The CVSS score of 5.9 indicates a medium severity. No EPSS score is available and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no widespread exploitation to date. The attack vector is likely network‑based, requiring an attacker to send specially crafted DNS queries to the vulnerable DNS service, which is accessible from the network, thereby enabling an unprivileged network attacker to force a service restart and disrupt DNS availability.

Generated by OpenCVE AI on September 9, 2026 at 02:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Microsoft cumulative update that resolves the use‑after‑free issue in the DNS server; use the Microsoft Security Update Guide or Windows Update (reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78523).
  • Restrict inbound DNS request traffic to trusted IP ranges by configuring firewall rules or network segmentation so that only authorized clients can query the DNS server.
  • Implement DNS server redundancy or fail‑over, such as configuring a secondary DNS server or using DNS routing, to maintain service availability in case a DoS occurs.

Generated by OpenCVE AI on September 9, 2026 at 02:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 10 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows Server 2012 (server Core Installation)
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows Server 2012 (server Core Installation)
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)

Thu, 10 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

Tue, 08 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Use after free in Windows DNS allows an unauthorized attacker to deny service over a network.
Title Windows DNS Server Denial of Service Vulnerability
First Time appeared Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows Server 2012
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
Weaknesses CWE-416
CPEs cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows Server 2012
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows 10 1607 Windows 10 1809 Windows Server 2012 Windows Server 2012 (server Core Installation) Windows Server 2012 R2 Windows Server 2012 R2 Windows Server 2012 R2 (server Core Installation) Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 Windows Server 2019 (server Core Installation) Windows Server 2022 Windows Server 2025 Windows Server 2025 (server Core Installation)
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-09-25T21:33:46.163Z

Reserved: 2026-08-24T17:28:00.623Z

Link: CVE-2026-78523

cve-icon Vulnrichment

Updated: 2026-09-08T20:51:46.523Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-08T18:20:47.950

Modified: 2026-09-24T23:19:09.000

Link: CVE-2026-78523

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T21:05:28Z

Weaknesses