Out-of-bounds read in Windows Server - CVE-2026-119971
Published: November 11, 2026
Vulnerability identifier: #VU165389
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119971
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to disclose heap memory from a privileged process running on the server.
The vulnerability exists due to an out-of-bounds read in Windows DNS Server when handling network requests. A remote privileged user can send specially crafted requests to read memory beyond the intended buffer boundaries and disclose information from the server process.
Affected software
Windows Server
How to mitigate CVE-2026-119971
Install security update from vendor's website.
Windows Server - addressed in versions 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33730, 2025 10.0.26100.33822