CVE-2026-41096
CRITICAL · 9.8 EPSS 0.1%Real critical vuln with vendor patch and defender triage; no PoC/KEV yet, no exploitation signal confirmed.
What: Heap-based buffer overflow in Microsoft Windows DNS Client allowing unauthenticated remote code execution (CVSS 9.8 Critical). Affects Windows 11 and Windows Server 2022/2025.
Why it matters: Microsoft patched this on May 12, 2026 Patch Tuesday alongside 136 other vulnerabilities (31 critical). Social chatter shows defenders actively hunting in logs and incident response teams prioritizing patching. No KEV listing yet and no public PoC reported, but critical CVSS and immediate patching signal severity. No active in-the-wild exploitation mentioned.
Where it's seen: Patch Tuesday advisories, Advanced Hunting queries circulating among blue teams, cross-vulnerability roundup posts lumping it with other critical RCEs (Netlogon CVE-2026-41089). Practitioners discussing patch prioritization and detection logic.
RISK: CRITICAL — Unauthenticated network RCE affecting mainstream Windows clients and servers; immediate patching required.
Description
Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High