Executive brief
Microsoft DNS Server is a core network service that resolves domain names to IP addresses for Windows environments. A race condition vulnerability in concurrent request handling could allow an attacker to execute arbitrary code remotely, potentially compromising the entire network's DNS infrastructure and enabling widespread attacks on connected systems.
Technical details
A race condition exists in Microsoft DNS Server's shared resource handling during concurrent execution, where improper synchronization of access to shared data allows an attacker to trigger a code execution condition. The vulnerability is remotely exploitable over the network without requiring prior authentication. An attacker can send crafted DNS requests that trigger the race condition to execute arbitrary code with DNS Server privileges. Patches are available from Microsoft.
Affected products
- Microsoft DNS Server
Timeline
- 2026-09-08: disclosed