cbcvebase.
CVE-2026-41096
published 2026-05-12

CVE-2026-41096: Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.

PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.93%
77.9th percentile
Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.

Affected

12 ranges
VendorProductVersion rangeFixed in
microsoftwindows_11_23h2< 10.0.22631.707910.0.22631.7079
microsoftwindows_11_24h2< 10.0.26100.839010.0.26100.8390
microsoftwindows_11_25h2< 10.0.26200.839010.0.26200.8390
microsoftwindows_11_26h1< 10.0.28000.211310.0.28000.2113
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.707910.0.22631.7079
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.721910.0.22631.7219
microsoftwindows_11_version_24h2>= 10.0.26100.0 < 10.0.26100.845710.0.26100.8457
microsoftwindows_11_version_25h2>= 10.0.26200.0 < 10.0.26200.845710.0.26200.8457
microsoftwindows_11_version_26h1>= 10.0.28000.0 < 10.0.28000.211310.0.28000.2113
microsoftwindows_server_2022_23h2< 10.0.25398.233010.0.25398.2330
microsoftwindows_server_2025< 10.0.26100.3277210.0.26100.32772
microsoftwindows_server_2025>= 10.0.26100.0 < 10.0.26100.3286010.0.26100.32860

Detection & IOCsextracted from sources · hover to see the quote

  • CVE-2026-41096 is a critical Remote Code Execution vulnerability in the Windows DNS client implementation; network-based detection should focus on anomalous or malformed DNS client traffic targeting Windows hosts
  • The vulnerability is a heap-based buffer overflow in Microsoft Windows DNS, exploitable over the network by an unauthorized attacker; monitor for unexpected DNS client crashes or heap corruption indicators on Windows endpoints
  • ·Microsoft assessed exploitation of CVE-2026-41096 as less likely, which may affect prioritization in detection/response workflows
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.