CVE-2026-78523

Microsoft's Windows DNS component contains a use-after-free vulnerability (CWE-416) that can be triggered remotely by unauthenticated network traffic processed by the DNS service. An attacker who sends crafted DNS requests to a vulnerable system can cause memory corruption that crashes the DNS service, resulting in denial of service; the CVSS vector (availability-only impact, high) indicates no confidentiality or integrity loss and no code execution. Affected products are Windows 10 1607 and 1809 and Windows Server 2012, 2016, 2019, 2022, and 2025, and because Windows domain controllers typically run the DNS Server role, most Active Directory environments are plausibly exposed. As of the latest data there is no known exploitation in the wild (not in CISA KEV), no public proof-of-concept, and EPSS estimates only about a 0.9% probability of exploitation within 30 days (57th percentile).

What to do: Apply the Microsoft security update addressing CVE-2026-78523 to all systems running the DNS Server role when it is released, prioritizing internet-facing DNS servers and domain controllers. Until patched, restrict inbound TCP/UDP 53 at the perimeter to trusted resolvers and clients, and monitor DNS service health and crash events. With no known exploitation and low EPSS, this is routine patching rather than an emergency, but note that a successful attack degrades name resolution org-wide.