Overview of CVE-2026-112727: Windows DNS Untrusted Pointer Dereference Leading to Remote Code Execution

Introduction

Microsoft's November 10, 2026 Patch Tuesday release fixed a memory-safety flaw in the Windows Domain Name Service that can let an attacker run code on a Windows machine after a user connects to a malicious server. Because the affected product list covers Windows 10, Windows 11 and every Windows Server release from 2012 through 2025, the exposure question reaches well beyond the domain controllers and DNS servers most teams would check first.

Microsoft rates the issue CVSS 8.8 (High) and Important on its own severity scale, and it shipped an Official Fix in the monthly cumulative updates. At publication, neither Microsoft nor CISA reported exploitation in the wild. Below we summarize what the published record does and does not tell us.

Technical information

Root cause: CWE 822, Untrusted Pointer Dereference

The published description reads: "Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network." The assigned weakness is CWE 822.

MITRE defines this class as a product that obtains a value from an untrusted source, converts that value into a pointer, and then dereferences it. The consequences depend on what the code does with the resulting address:

An invalid read may expose information or crash the process.
A write may modify critical state or permit code execution.
Use as a function pointer may invoke a function chosen by the attacker.

In this case, Microsoft's patch documentation indicates the attacker-influenced value originates in data from a DNS response, and that data ends up treated as a memory address. These category-level outcomes describe the bug class. Microsoft has not disclosed which of them applies to the exact implementation flaw.

Documented attack flow

Microsoft's FAQ describes the following sequence:

The attacker hosts a malicious server.
The attacker convinces a user to connect to that server from an affected client.
The client processes the server's response.
During that processing, the attacker could execute code on the client system.

That places the vulnerable code on the path that parses responses. It also raises a naming problem. The description says "DNS Server," yet the FAQ describes code execution on an affected client, and the affected products include desktop Windows releases. Microsoft's documentation explains that the DNS Client service exists on both client and server editions of Windows, while DNS Server is an installable Windows Server role. That background supports keeping the two concepts distinct, but it does not identify which internal component contains the defect. Our takeaway: do not scope your exposure review only to machines running the DNS Server role.

Reading the CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

AV:N (Network): exploitation can occur over a network.
AC:L (Low): the published attack complexity is Low.
PR:N (None): no prior attacker authorization is needed.
UI:R (Required): a user must take an action, which in the FAQ scenario means connecting to the attacker's server. This is not an interaction-free network attack.
S:U (Unchanged): scope is unchanged.
C:H/I:H/A:H: High impact for confidentiality, integrity and availability.
E:U/RL:O/RC:C: exploit code maturity Unproven, remediation level Official Fix, report confidence Confirmed. The resulting temporal score is 7.7.

These values come from Microsoft. NVD displays Microsoft's assessment but notes that its own assessment has not yet been provided, so 8.8 is not a separately completed NIST score.

What is not public

Windows is closed source, and Microsoft has published no diff, commit or root-cause write-up, so no vulnerable code can be shown. The reviewed sources do not identify the vulnerable function, the packet fields involved, the exact pointer manipulation, the security context of the affected process, any required DNS configuration, or a complete exploit chain. Nothing in the record establishes automatic propagation.

Patch information

Microsoft fixed CVE-2026-112727 in its November 10, 2026 Patch Tuesday release. The MSRC advisory sets Remediation Level = Official Fix, meaning Microsoft considers the patch a complete fix rather than a workaround or hotfix. The advisory has one revision: 1.0, "Information published" on November 10, 2026.

What the fix addresses

The fix targets the untrusted pointer dereference on the DNS response parsing path. Microsoft has not described how it was implemented. As general background on the bug class only, fixes for CWE 822 usually stop the program from trusting pointer or offset values taken from parsed data, either by checking bounds and type before dereferencing or by deriving the address from trusted internal state. Microsoft has not confirmed that either approach was used here.

How the fix is delivered

There is no separate DNS hotfix. The fix ships inside each Windows release's November 2026 cumulative security update. The fixed builds below come from the MSRC Security Updates table and match the upper bounds of the affected ranges on NVD:

Windows Server 2012 and 2012 (Server Core): KB5126835, fixed build 6.2.9200.26434
Windows Server 2012 R2 and 2012 R2 (Server Core): KB5126836, fixed build 6.3.9600.23470
Windows 10 1607 (32 bit and x64), Windows Server 2016 and 2016 (Server Core): KB5126868, fixed build 10.0.14393.9612
Windows 10 1809 (32 bit and x64), Windows Server 2019 and 2019 (Server Core): KB5126651, fixed build 10.0.17763.9376
Windows 10 21H2 (32 bit, x64, ARM64): KB5126657, fixed build 10.0.19044.7807
Windows 10 22H2 (32 bit, x64, ARM64): KB5126657, fixed build 10.0.19045.7807
Windows Server 2022 and 2022 (Server Core): KB5126655, fixed build 10.0.20348.5761
Windows 11 23H2 (x64, ARM64): KB5126653, fixed build 10.0.22631.7652
Windows 11 24H2 (x64, ARM64): KB5127648, fixed build 10.0.26100.9711
Windows 11 25H2 (x64, ARM64): KB5127648, fixed build 10.0.26200.9711
Windows 11 26H2 (x64, ARM64): KB5127648, fixed build 10.0.26300.9711
Windows 11 26H1 (x64, ARM64): KB5127646, fixed build 10.0.28000.3231
Windows Server 2025 and 2025 (Server Core): KB5126646, fixed build 10.0.26100.33650

Two details are easy to get wrong:

Windows 11 24H2 and Windows Server 2025 share build 10.0.26100 but have different fix levels. Windows 11 24H2 is fixed at revision .9711 (KB5127648), while Windows Server 2025 needs revision .33650 (KB5126646). Check each system against its own row.
One KB can cover several product lines. KB5127648 covers Windows 11 24H2, 25H2 and 26H2. KB5126651 covers Windows 10 1809 and Server 2019. KB5126868 covers Windows 10 1607 and Server 2016.

Verifying patch status

Compare the full OS build and revision (for example from winver, or the CurrentBuild and UBR registry values) with the fixed build above. A system is patched when its build is at or above the fixed build. Each MSRC entry links to its Microsoft Update Catalog package (catalog.update.microsoft.com/v7/site/Search.aspx?q=KB…), so systems that cannot use Windows Update or WSUS can be updated manually.

The reviewed materials do not establish any workaround, registry setting, firewall rule, service-disabling instruction or configuration change as an equivalent substitute for the official update.

Affected systems and versions

NVD and the CVE record mark versions starting at the first value and below the second value as affected (the upper bound is exclusive). Listed Server Core installations share the boundaries of their corresponding server release.

Windows 10

1607: 10.0.14393.0 up to, but not including, 10.0.14393.9612
1809: 10.0.17763.0 up to, but not including, 10.0.17763.9376
21H2: 10.0.19044.0 up to, but not including, 10.0.19044.7807
22H2: 10.0.19045.0 up to, but not including, 10.0.19045.7807

Windows 11

23H2: 10.0.22631.0 up to, but not including, 10.0.22631.7652
24H2: 10.0.26100.0 up to, but not including, 10.0.26100.9711
25H2: 10.0.26200.0 up to, but not including, 10.0.26200.9711
26H1: 10.0.28000.0 up to, but not including, 10.0.28000.3231
26H2: 10.0.26300.0 up to, but not including, 10.0.26300.9711

Windows Server (including Server Core)

2012: 6.2.9200.0 up to, but not including, 6.2.9200.26434
2012 R2: 6.3.9600.0 up to, but not including, 6.3.9600.23470
2016: 10.0.14393.0 up to, but not including, 10.0.14393.9612
2019: 10.0.17763.0 up to, but not including, 10.0.17763.9376
2022: 10.0.20348.0 up to, but not including, 10.0.20348.5761
2025: 10.0.26100.0 up to, but not including, 10.0.26100.33650

The records do not specify a DNS configuration that is required for exploitation, and they do not support a claim that every machine with DNS functionality is exposed under every configuration. The product list does, however, include desktop releases, consistent with Microsoft's client-side attack scenario.

Threat status at publication

Exploited in the wild: Microsoft says No at original publication, and CISA enrichment says none.
Exploitation likelihood: Microsoft assesses Exploitation Less Likely.
Exploit maturity: Unproven.
Automatable: CISA enrichment says no. Technical Impact is listed as total.
CISA KEV: absent from the full catalog snapshot version 2026.11.10 (release time 2026-11-10T19:03:29.8375Z). That finding is limited to that snapshot.
Named actors, campaigns or indicators: none identified for this CVE in the reviewed sources.

High potential impact and unconfirmed exploitation answer different questions, so the two findings do not contradict each other.

Vendor security history

Microsoft is both the affected vendor and the CNA for this record. Windows DNS is the default name resolution service in Windows networks, DNS Server is a Windows Server role, and creating a new Active Directory forest and domain automatically installs DNS alongside it. Clients use it to resolve names and locate domain controllers. The record does not quantify vulnerable deployments.

On the broader track record, the Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion found that the intrusion was preventable, concluded that Microsoft's security culture was inadequate and required an overhaul, and noted that Microsoft relied on a customer to identify anomalies rather than detecting the compromise of its cryptographic assets itself. The Board attributed that intrusion to Storm0558 (written by the CSRB with a hyphen), an actor it assessed as affiliated with the People's Republic of China. That incident involved different technology and has no established connection to CVE-2026-112727.

Microsoft's November 2025 Secure Future Initiative progress report describes a reform program built on Secure by Design, Secure by Default and Secure Operations, including locked-down endpoints for production access across Microsoft tenants and continued expansion of network isolation. These are vendor-reported changes to Microsoft's own environment, not mitigation guidance for this CVE. Neither the historical review nor the reform program says anything about how this specific vulnerability arose or whether it is being exploited.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical information