CVE-2026-85903
8.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-822
Impact
Remote attackers can execute arbitrary code on the DNS Server by luring a user or triggering an interaction over the network. They require no elevated privileges or authentication to launch the attack.
Root cause
An untrusted pointer dereference flaw mishandles memory during network processing.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Apply the security patch from the Microsoft MSRC advisory, or block unauthorized inbound access to the DNS Server port (UDP/TCP 53) from untrusted networks if patching must wait.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.