CVE-2026-41096: Windows DNS Client Remote Code Execution Vulnerability
CVE-2026-41096 is a remote code execution vulnerability in Windows DNS Client, rated Critical by Microsoft, with a CVSS 3.1 base score of 9.8 (Critical). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as unlikely. The EPSS model estimates a 2.70% probability of exploitation activity in the next 30 days, higher than 86% of all scored vulnerabilities. Microsoft released the fix on 12 May 2026 in the May 2026 Patch Tuesday, delivered through 8 security updates (KB5087539, KB5087423, KB5089549, KB5089466 and more). It affects 11 products in 1 product family (Windows).
Key facts
- CVE ID
- CVE-2026-41096
- Severity
- Critical CVSS 9.8
- Microsoft severity
- Critical
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Unlikely
- Weakness
- CWE-122
- EPSS
- 2.70% (percentile 86%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- May 2026 Patch Tuesday
- Product families
- Windows
From the May 2026 Patch Tuesday briefing
Windows DNS Client Remote Code Execution
This issue can allow an attacker to execute code on a Windows system by triggering a malicious DNS response or DNS-related network condition, potentially compromising endpoints and servers that rely on DNS resolution. A realistic scenario is an attacker who can influence DNS responses (through a compromised DNS server, rogue network position, or malicious infrastructure) and uses that to compromise systems at scale. This is another CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) critical RCE, driven by a heap-based buffer overflow (CWE-122) in the Windows DNS Client. The key operational translation of the vector is: an attacker can trigger RCE over the network without credentials and without user interaction, typically by inducing a target to process malicious DNS responses. In real environments, that can happen via compromised/rogue DNS infrastructure, on-path attackers (e.g., hostile Wi-Fi, compromised network devices), or internal adversaries who can influence name resolution (e.g., via DHCP/DNS poisoning in flat networks).
From the briefing, written by an AI model from PatchaPalooza's data.
CVSS score and vector
Microsoft scores CVE-2026-41096 at 9.8 (temporal 8.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.
Frequently asked questions (Microsoft)
How could an attacker exploit the vulnerability?
An attacker could exploit this vulnerability by sending a specially crafted DNS response to a vulnerable Windows system, causing the DNS Client to incorrectly process the response and corrupt memory. In certain configurations, this could allow the attacker to run code remotely on the affected system without authentication.
Affected products (11)
Windows
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Windows Server 2025 (Server Core installation) | KB5087539 KB5087423 | Security Update Security Hotpatch Update | 10.0.26100.32860 10.0.26100.32772 | Yes Yes |
| Windows 11 Version 25H2 for ARM64-based Systems | KB5089549 KB5089466 | Security Update Security Hotpatch Update | 10.0.26200.8457 10.0.26200.8390 | Yes Yes |
| Windows 11 Version 25H2 for x64-based Systems | KB5089549 KB5089466 | Security Update Security Hotpatch Update | 10.0.26200.8457 10.0.26200.8390 | Yes Yes |
| Windows 11 Version 23H2 for ARM64-based Systems | KB5087420 | Security Update | 10.0.22631.7079 | Yes |
| Windows 11 Version 23H2 for x64-based Systems | KB5093998 | Security Update | 10.0.22631.7219 | Yes |
| Windows Server 2022, 23H2 Edition (Server Core installation) | KB5087541 | Security Update | 10.0.25398.2330 | Yes |
| Windows 11 Version 24H2 for ARM64-based Systems | ||||
| Windows 11 Version 24H2 for x64-based Systems | ||||
| Windows Server 2025 | KB5087539 KB5087423 | Security Update Security Hotpatch Update | 10.0.26100.32860 10.0.26100.32772 | Yes Yes |
| Windows 11 version 26H1 for x64-based Systems | KB5089548 | Security Update | 10.0.28000.2113 | Yes |
| Windows 11 Version 26H1 for ARM64-based Systems | KB5089548 | Security Update | 10.0.28000.2113 | Yes |
Security updates (8)
Exploitation and detection
Detection and weaponization
Weaponization maturity: Exploit.
Proof-of-concept repositories (6)
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 9.8 (CRITICAL)
- NVD weakness
- CWE-122
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| windows 11 23h2 (arm64) | before 10.0.22631.7079 |
| windows 11 23h2 (x64) | before 10.0.22631.7079 |
| windows 11 24h2 (arm64) | before 10.0.26100.8390 |
| windows 11 24h2 (x64) | before 10.0.26100.8390 |
| windows 11 25h2 (arm64) | before 10.0.26200.8390 |
| windows 11 25h2 (x64) | before 10.0.26200.8390 |
| windows 11 26h1 (arm64) | before 10.0.28000.2113 |
| windows 11 26h1 (x64) | before 10.0.28000.2113 |
| windows server 2022 23h2 | before 10.0.25398.2330 |
| windows server 2025 | before 10.0.26100.32772 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096 (Vendor Advisory)
Acknowledgments
- WARP team at Microsoft
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |