Out-of-bounds write in Windows DNS

CVE-2026-62817 is an out-of-bounds write (CWE-787) in the Windows DNS Server service. An unauthenticated attacker on the same Layer 2 network segment can send specially crafted DNS packets to trigger a memory corruption condition, achieving remote code execution as SYSTEM. The flaw affects Windows Server 2019, 2022, and 2025 — plus, notably, Windows 10 (all supported versions through 22H2) and Windows 11 (through 26H1) when the DNS Server role is enabled. It was disclosed on 2026-08-11 as part of Microsoft's August 2026 Patch Tuesday, alongside three sibling DNS Server RCE bugs: CVE-2026-62878 (stack overflow, CVSS 9.8), CVE-2026-62820 (race condition, 8.1), and CVE-2026-65789 (use-after-free, 8.1).

Microsoft rates this Important / HIGH at 8.8, and the score is honest given the CVSS vector's AV:A constraint — the attack is limited to an adjacent network, not the internet. However, the vendor score doesn't tell you *where* the DNS Server role actually runs in production. In the overwhelming majority of Active Directory environments, DNS Server is co-located on domain controllers. That means a successful exploit doesn't just give you SYSTEM on 'a DNS server' — it gives you SYSTEM on a domain controller, which is one hop from DA and full domain compromise. The vendor score is mechanically correct but understates the blast radius for canonical AD deployments.

Why this verdict

• AV:A constraint already priced in: The vendor's 8.8 CVSS already reflects the adjacent-network limitation. The score is mechanically correct. We shave 0.8 points for the additional real-world friction of VLAN segmentation in mature enterprises, no PoC availability, and zero in-the-wild exploitation.
• Role multiplier: DNS Server ≈ Domain Controller. In >80% of AD deployments, the Windows DNS Server role runs directly on domain controllers. RCE as SYSTEM on a DC yields DCSync → KRBTGT extraction → Golden Ticket → full domain/forest compromise. This chain succeeds trivially once step 3 is reached. Blast radius = domain-scale to forest-scale. This floors the verdict at HIGH regardless of other friction.
• No exploitation signal suppresses urgency but not severity. Zero EPSS percentile, no KEV, no PoC, no campaign attribution. This is a theoretical risk today — but DNS parsing bugs have historically been weaponized within 30-60 days of patch release (cf. SIGRed / CVE-2020-1350). The clock is ticking.
• Sibling CVE-2026-62878 (9.8, AV:N) overshadows but does not eliminate this risk. Defenders will rightly prioritize the network-exploitable sibling, but CVE-2026-62817 remains a potent post-compromise escalation vector for attackers already inside the network perimeter.

Why not higher?

Upgrading to CRITICAL would require either active exploitation evidence or a network-reachable (AV:N) attack vector. The AV:A constraint means this bug cannot be exploited from the internet or even from a different VLAN without prior compromise of the DC's network segment. No PoC exists, EPSS is sub-1%, and there is no KEV listing. The sibling CVE-2026-62878 at 9.8 with AV:N is the one that warrants CRITICAL treatment.

Why not lower?

Downgrading to MEDIUM would ignore that the canonical target — a domain controller — represents one of the highest-value hosts in any enterprise. An unauthenticated, low-complexity RCE on a DC is a domain-ending event. The AV:A requirement is real friction but does not eliminate the threat: flat networks, misconfigured VLANs, and compromised hosts on server segments are common realities. The DC role multiplier floors this at HIGH.

1. Isolate DCs on dedicated VLANs with strict L2 ACLs — The AV:A attack vector requires Layer 2 adjacency. Placing domain controllers on a dedicated VLAN with switch-level ACLs that deny all non-essential L2 traffic from workstation/user segments is the single most effective compensating control. Validate or deploy within the noisgate mitigation SLA of 30 days. Most mature environments already have this; verify it's enforced, not just documented.
2. Deploy IDS/IPS signatures for malformed DNS traffic — Cisco Talos released Snort rules for the August 2026 Patch Tuesday DNS cluster. Deploy these on network segments where DNS servers reside. This provides detection-in-depth even if segmentation has gaps. Deploy within 30 days per noisgate mitigation SLA.
3. Enable Windows Defender Exploit Guard on DNS servers — Configure Exploit Guard's mandatory ASLR, CFG, and export address filtering for dns.exe. This raises the exploitation bar significantly for memory corruption bugs. Apply via Group Policy to all servers running the DNS role.
4. Monitor dns.exe for anomalous behavior via EDR — Create detection rules for dns.exe spawning unexpected child processes (cmd.exe, powershell.exe, rundll32.exe). Any code execution from the DNS service should be treated as a critical alert. Most EDR platforms can scope this within hours.
5. Audit DNS Server role placement — Identify any DNS Server instances running on non-DC hosts (uncommon but possible). If DNS is running on member servers or client SKUs, evaluate whether the role can be removed. Reducing the attack surface is preferable to defending it.

Run this script on each Windows Server host running the DNS Server role (typically your domain controllers). Execute as Administrator in an elevated PowerShell session. Example: .\Check-CVE-2026-62817.ps1. No external dependencies required.

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Checks whether the Windows DNS Server role is installed and whether the
    August 2026 cumulative update has been applied (CVE-2026-62817 mitigation).
.NOTES
    Outputs VULNERABLE, PATCHED, or UNKNOWN.
    Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

# Check if DNS Server role is installed
$dnsRole = Get-WindowsFeature -Name DNS -ErrorAction SilentlyContinue
if (-not $dnsRole -or -not $dnsRole.Installed) {
    Write-Host "UNKNOWN - DNS Server role is not installed on this host. Not affected."
    exit 2
}

Write-Host "[*] DNS Server role is INSTALLED on this host."

# Check for August 2026 cumulative updates
# August 2026 Patch Tuesday was 2026-08-11; updates released 2026-08-12
$augustPatches = Get-HotFix | Where-Object {
    $_.InstalledOn -ge [DateTime]'2026-08-11'
} | Sort-Object InstalledOn -Descending

if ($augustPatches.Count -gt 0) {
    $latest = $augustPatches[0]
    Write-Host "PATCHED - Found post-August-2026 update: $($latest.HotFixID) installed on $($latest.InstalledOn.ToString('yyyy-MM-dd'))."
    Write-Host "Verify this KB against Microsoft Security Update Guide for CVE-2026-62817 coverage."
    exit 0
} else {
    # Cross-check dns.exe file version as secondary signal
    $dnsExe = "$env:SystemRoot\System32\dns.exe"
    if (Test-Path $dnsExe) {
        $ver = (Get-Item $dnsExe).VersionInfo.ProductVersion
        Write-Host "[*] dns.exe version: $ver"
    }
    Write-Host "VULNERABLE - No cumulative update from August 2026 or later detected."
    Write-Host "Apply the August 2026 cumulative update immediately."
    exit 1
}

Sources

1. CVE-2026-62817 Detail — CVEFeed.io
2. Microsoft Patch Tuesday August 2026 — Cisco Talos
3. August 2026 Patch Tuesday Analysis — CrowdStrike
4. Microsoft Patch Tuesday August 2026 — SANS ISC
5. Microsoft Security Update Guide
6. DNS Overview — Microsoft Learn
7. CVE-2026-62878 Windows DNS Server RCE — WindowsForum