Out-of-bounds read in Windows Server - CVE-2026-108425
Published: November 10, 2026
Vulnerability identifier: #VU164724
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108425
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information from the memory of the affected DNS Server service.
The vulnerability exists due to an out-of-bounds read in Windows DNS when handling network DNS traffic. A remote attacker can send specially crafted DNS packets to read memory from the affected DNS Server service.
Successful exploitation requires DNS packet debug logging to be enabled on the affected server. This logging is disabled by default.
Affected software
Windows Server
How to mitigate CVE-2026-108425
Install security update from vendor's website.
Windows Server - addressed in versions 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33730, 2025 10.0.26100.33822