CVE-2026-41096

9.8

CRITICAL CVSS 3.1

Windows DNS Client Remote Code Execution Vulnerability

Overview

Description

Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.

Details

INFO

Published Date :

May 12, 2026, 6:17 p.m.

Last Modified :

May 15, 2026, 3:38 p.m.

Remotely Exploit :

No

Source :

[email protected]

Impact

Affected Products

The following products are affected by CVE-2026-41096 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Microsoft	windows_11
2	Microsoft	windows_11_23h2
3	Microsoft	windows_server_2022_23h2
4	Microsoft	windows_server_23h2
5	Microsoft	windows_11_24h2
6	Microsoft	windows_server_2025
7	Microsoft	windows_11_25h2
8	Microsoft	windows_11_26h1

: Total Affected Vendor : 1 | Products : 8

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				f38d906d-7342-40ea-92c1-6c4a2c6478c8
	CVSS 3.1	CRITICAL				[email protected]

Public PoC/Exploit Available at Github

CVE-2026-41096 has a 5 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-41096.

URL	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096	Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-41096 is associated with the following CWEs:

CWE-122: Heap-based Buffer Overflow

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-41096 weaknesses.

CAPEC-92: Forced Integer Overflow Forced Integer Overflow

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

m0n1x90/CVE-2026-41096

CVE-2026-41096: Heap Overflow in the Windows DNS Client

Python C

Updated: 1 week ago

1 stars 1 fork 1 watcher

Born at : May 24, 2026, 2:23 p.m. This repo has been linked 1 different CVEs too.

satchfunky/CVE-2026-41096-POC

windows api bug

C Python

Updated: 1 week ago

25 stars 4 fork 4 watcher

Born at : May 24, 2026, 12:46 a.m. This repo has been linked 1 different CVEs too.

CryptReaper12/CVE-2026-41096

None

Updated: 2 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : May 18, 2026, 1:40 a.m. This repo has been linked 1 different CVEs too.

ByteWraith1/CVE-2026-41096

None

Updated: 2 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : May 16, 2026, 2:30 a.m. This repo has been linked 1 different CVEs too.

mrk336/DNS-Mayhem-CVE-2026-41096-Deep-Dive

In‑depth technical analysis of CVE‑2026‑41096, a critical heap overflow in Windows DNSAPI.dll enabling remote code execution via crafted DNS responses. Includes attack vectors, patch insights, and defensive guidance for security teams.

Updated: 2 weeks ago

2 stars 1 fork 1 watcher

Born at : May 15, 2026, 7:30 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-41096 vulnerability anywhere in the article.

CybersecurityNews

Windows DNS Client Vulnerability Enables Remote Code Execution Attacks

A newly disclosed vulnerability in the Microsoft Windows DNS Client could let attackers silently execute malicious code across enterprise networks, exposing a massive attack surface. Officially design ...

Published Date: May 14, 2026 (2 weeks, 4 days ago)

security.nl

Kritiek beveiligingslek in Windows Server maakt computerworm mogelijk

Een kritieke kwetsbaarheid in Windows Server maakt het mogelijk voor een computerworm om zich zonder interactie van gebruikers te verspreiden. Twee andere kwetsbaarheden in Windows zijn ook zonder geb ...

Published Date: May 13, 2026 (2 weeks, 5 days ago)

The Cyber Express

Microsoft May 2026 Patch Tuesday Fixes 120 Vulnerabilities, No Zero-Day Exploits Reported

Microsoft has rolled out its May 2026 Patch Tuesday security updates, delivering fixes for approximately 120 vulnerabilities across Windows, Microsoft Office, networking services, and enterprise platf ...

Published Date: May 13, 2026 (2 weeks, 5 days ago)

CrowdStrike.com

May 2026 Patch Tuesday: 30 Critical Vulnerabilities Among 130 CVEs

Microsoft has addressed 130 vulnerabilities in its May 2026 security update release, fewer than April’s 164 vulnerabilities. This month's patches include fixes for 30 Critical vulnerabilities, along w ...

Published Date: May 13, 2026 (2 weeks, 6 days ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-41096 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

Initial Analysis by [email protected]

May. 15, 2026

Action	Type	Old Value	New Value
Added	CPE Configuration		OR cpe:2.3:o:microsoft:windows_11_26h1:::::::arm64: versions up to (excluding) 10.0.28000.2113 cpe:2.3:o:microsoft:windows_11_26h1:::::::x64: versions up to (excluding) 10.0.28000.2113 cpe:2.3:o:microsoft:windows_11_23h2:::::::arm64: versions up to (excluding) 10.0.22631.7079 cpe:2.3:o:microsoft:windows_11_23h2:::::::x64: versions up to (excluding) 10.0.22631.7079 cpe:2.3:o:microsoft:windows_11_24h2:::::::arm64: versions up to (excluding) 10.0.26100.8390 cpe:2.3:o:microsoft:windows_11_24h2:::::::x64: versions up to (excluding) 10.0.26100.8390 cpe:2.3:o:microsoft:windows_11_25h2:::::::arm64: versions up to (excluding) 10.0.26200.8390 cpe:2.3:o:microsoft:windows_11_25h2:::::::x64: versions up to (excluding) 10.0.26200.8390 cpe:2.3:o:microsoft:windows_server_2022_23h2::::::::* versions up to (excluding) 10.0.25398.2330 cpe:2.3:o:microsoft:windows_server_2025::::::::* versions up to (excluding) 10.0.26100.32772
Added	Reference Type		Microsoft Corporation: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096 Types: Vendor Advisory

New CVE Received by [email protected]

May. 12, 2026

Action	Type	New Value
Added	Description	Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.
Added	CVSS V3.1	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Added	CWE	CWE-122
Added	Reference	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.