Overview of CVE-2026-81384: Heap Buffer Overflow in Windows DNS Server Enables Conditional Remote Code Execution

Introduction

Windows DNS Server sits underneath Active Directory in most Windows estates: it is installed automatically when a new forest and domain are created, and domain controllers depend on it to locate one another and to serve authentication, updates and searches. Microsoft's November 10, 2026 Patch Tuesday fixed CVE-2026-81384, a heap-based buffer overflow in that service that can give an unauthenticated network attacker code execution, but only on servers running a specific nondefault plugin and configuration.

This post is a brief summary of what Microsoft and the public records disclose, what they leave out, and how to confirm the fix is in place. One note on the raw feed data: NVD's ingest lists the vendor as Unknown, but the CNA and the vendor named in the primary CVE record is Microsoft, and the affected component is the DNS Server role inside Windows Server.

Technical information

Root cause

Microsoft classifies the flaw as CWE 122, a heap-based buffer overflow in the DNS Server service. MITRE's CWE 122 definition covers overflows of a buffer that was allocated in heap memory, commonly through a routine such as malloc(). That describes the weakness class, not the specific defect.

Microsoft has not disclosed which routine changed, and Windows DNS Server is closed source, so there is no public commit or diff to inspect. For bugs in this class, the usual fix is to check lengths and bounds before data from a network packet is copied into a heap buffer, in this case within the plugin-related code path. That is our inference from the CWE class. Microsoft has not confirmed it.

Attack preconditions and flow

The advisory's FAQ gives a short but clear exploitation sequence:

1. The target is an affected Windows Server build running the DNS Server role.
2. The server uses a specific nondefault server plugin and configuration. Microsoft states this combination is not present in a default installation, and does not name the plugin or its settings.
3. An unauthenticated attacker sends a specially crafted packet to the DNS Server service over the network. No authentication and no user interaction are required.
4. Successful exploitation could result in code execution on the target system.

Microsoft adds that exploitation requires deep understanding of the system and that success depends on factors including environment, configuration and additional security measures. The High attack complexity rating reflects this.

For defenders, the gaps in the advisory matter just as much. It does not disclose the vulnerable function, the relevant packet fields, the transport protocol, the network port, payload construction, heap layout, or the security context in which code would run. The public record supports a conditional network attack, not a reproducible exploit procedure.

CVSS breakdown

Microsoft's CNA vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• AV:N: reachable over the network
• AC:H: high attack complexity
• PR:N: no privileges required
• UI:N: no user interaction
• S:U: scope unchanged
• C:H / I:H / A:H: high potential impact to confidentiality, integrity and availability

This yields a base score of 8.1 (High). Microsoft also publishes a temporal score of 7.1:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Exploit maturity is Unproven, remediation level is Official Fix, and report confidence is Confirmed. NVD shows the entry as Awaiting Enrichment, so the 8.1 figure is Microsoft's assessment rather than an independent NVD score.

Exploitation status at disclosure

• Exploited: No (Microsoft)
• Publicly disclosed before release: No (Microsoft)
• Exploitability assessment: Exploitation Less Likely (Microsoft)
• Exploit maturity: Unproven, which Microsoft defines as no public exploit code being available or exploitation being theoretical
• CISA KEV: Senserva reports Not listed, and VulDB reports KEV no
• Attribution: No threat actor, campaign, malware family or victim identified in the reviewed reporting

The high CVSS impact and the Less Likely rating answer different questions. CVSS describes what happens if the stated conditions are met; the exploitability rating describes how likely successful exploitation is. The nondefault prerequisite and high complexity explain why both can be true at once. Neither supports treating every DNS server as equally exposed, and neither supports treating the issue as harmless on servers that meet the conditions.

Patch information

Microsoft fixed CVE-2026-81384 in the November 10, 2026 Patch Tuesday release. The Security Update Guide sets the remediation level to Official Fix, defined as: "A complete vendor solution is available." The fix ships only inside the monthly cumulative updates (and the corresponding Hotpatch), so you verify it by build number rather than by reviewing code.

Fixed builds

• Windows Server 2022 (including Server Core): KB5131090 (cumulative), fixed OS build 10.0.20348.5870
• Windows Server 2025 (including Server Core): KB5131080 (cumulative), fixed OS build 10.0.26100.33822
• Windows Server 2025 (Hotpatch enrolled): KB5131077 (Hotpatch), fixed OS build 10.0.26100.33730

The KB release notes do not list the DNS change by name. They point readers to the November 2026 Security Update Guide for CVE details, which is normal for Windows cumulative updates.

Packaging and prerequisites

• Cumulative: KB5131090 includes the fixes from October's KB5126655 and the out-of-band KB5134140. KB5131080 includes October's KB5126646 and the out-of-band KB5134137. Only the latest package is needed.
• Servicing stack: Server 2022 needs SSU 20348.3920 or later, and KB5131090 ships with SSU KB5131089 (20348.5859). The Server 2022 support article also requires an existing Windows update released on or after July 8, 2025, such as KB5062572, for its stated deployment paths. Server 2025 needs SSU 26100.33822 or later, delivered as KB5131079.
• Manual Server 2025 installs: If you install KB5131080 by hand from the Update Catalog, install the checkpoint cumulative update KB5043080 first, or point DISM at a folder holding both MSUs so it applies them in order.
• Delivery: Both cumulative updates arrive through Windows Update, Windows Update for Business, the Microsoft Update Catalog and WSUS. In WSUS the product is Microsoft Server operating system 21H2 (2022) or 24H2 (2025), classification Security Updates.

The Hotpatch build-number caveat

KB5131077 applies the fix in memory, so the server does not need a reboot. It applies to Windows Server 2025 Datacenter: Azure Edition and to Azure Arc-connected Datacenter and Standard machines enrolled in Hotpatch. It is available only through Windows Update, not the Catalog or WSUS. The support article requires baseline KB5127648 and servicing stack version 26100.9703 or later.

MSRC lists build 26100.33730 for this path alongside 26100.33822 for the full cumulative update, while NVD records the affected range only as below 26100.33822. A scanner that compares versions strictly may therefore flag a hotpatched server as vulnerable. Before calling that a false positive, confirm that KB5131077 is actually installed. The reverse also holds: a build number lower than 26100.33822 is not by itself evidence of protection unless the Hotpatch path applies.

Confirming the fix

DNS Server is a role inside the OS, not a separately versioned product, so reaching the correct OS build is all it takes. Check the OS build and update build revision (UBR) values under:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

Alternatively, confirm that KB5131090, KB5131080 or KB5131077 appears in the installed updates list.

What is not a substitute

Microsoft did not publish a CVE-specific workaround. Its DNS query policy documentation for Windows Server 2022 and 2025 describes filtering queries by permitted subnet or server interface, which is reasonable hardening, but nothing in that documentation establishes that it blocks this memory-corruption flaw. Because the required plugin is not named, the advisory also does not give enough information to prescribe removing or reconfiguring it. The official update is the remediation.

Affected systems and versions

Per the primary CVE record (reflected in NVD), all x64:

• Windows Server 2022: 10.0.20348.0 up to, but not including, 10.0.20348.5870
• Windows Server 2025: 10.0.26100.0 up to, but not including, 10.0.26100.33822
• Windows Server 2025, Server Core installation: 10.0.26100.0 up to, but not including, 10.0.26100.33822

Senserva and the Microsoft update mapping also cover Windows Server 2022 Server Core under KB5131090, which is broader than the three entries in the reviewed primary CVE record. We are flagging that difference rather than collapsing it.

Vulnerable configuration: A server in these ranges is only exposed to the documented attack if the DNS Server role is running with the specific nondefault server plugin and configuration described by Microsoft. Version ranges determine which update applies. Configuration determines whether the documented attack conditions exist.

Vendor security history

The Windows DNS Server role has a notable precedent. CVE-2020-1350, patched by Microsoft on July 14, 2020, allowed an unauthenticated attacker sending malicious DNS requests to execute code in the Local System context. CISA issued Emergency Directive 20-03, citing widespread use of the affected Windows Server software across the federal enterprise. At the time CISA said it was unaware of active exploitation but assessed that the flaw could be quickly reverse-engineered from the public patch. That history does not mean CVE-2026-81384 runs as Local System, shares the same mechanism, or can use the older registry workaround. The current advisory explicitly describes high complexity and a nondefault prerequisite.

At the company level, the Cyber Safety Review Board independently reviewed the Summer 2023 Microsoft Exchange Online intrusion and made recommendations aimed at preventing incidents of that magnitude. Microsoft's July 2026 Secure Future Initiative report self-reports removing public access from 732,000 resources and remediating more than 550,000 instances of critical and high-risk open-source vulnerabilities. These figures are vendor reported and companywide, and they say nothing specific about this DNS fix.

References

• Microsoft Security Update Guide: CVE-2026-81384
• NVD entry for CVE-2026-81384
• CVE.org record for CVE-2026-81384
• KB5131090 (Windows Server 2022)
• KB5131090 release notes, OS Build 20348.5870
• KB5131080 release notes, OS Build 26100.33822 (en gb)
• KB5131080 release notes, OS Build 26100.33822 (en us)
• Hotpatch KB5131077, OS Build 26100.33730
• MITRE CWE 122: Heap Based Buffer Overflow
• Senserva CVE entry
• Casco CVE entry
• VulDB CVE entry
• Microsoft Learn: DNS in Windows and Windows Server
• Microsoft Learn: Use DNS Policy for Applying Filters on DNS Queries
• Microsoft Learn: Checklist, Secure Your DNS Server
• CISA ED 20-03: Windows DNS Server RCE (CVE-2020-1350)
• CISA: CSRB Report on Summer 2023 Microsoft Exchange Online Incident
• CISA: Adds Six Known Exploited Vulnerabilities to Catalog (November 10, 2026)
• Microsoft SFI Progress Report, July 2026