CVE-2026-41096

CRITICAL

Microsoft Windows 11 version 22H3 - Windows DNS Client Remote Code Execution Vulnerability

Title source: rule
STIX 2.1

Exploitation Summary

EIP tracks 5 public exploits for CVE-2026-41096. PoCs published by mrk336, m0n1x90, satchfunky.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2026-41096, a heap-based buffer overflow in Windows DNSAPI.dll. It includes an explanation of the vulnerability, exploitation scenarios, patch details, and defensive guidance, but does not contain functional exploit code.

Description

Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.

Exploits (5)

nomisec WRITEUP 1 stars
by mrk336 · poc
https://github.com/mrk336/DNS-Mayhem-CVE-2026-41096-Deep-Dive

This repository provides a detailed technical analysis of CVE-2026-41096, a heap-based buffer overflow in Windows DNSAPI.dll. It includes an explanation of the vulnerability, exploitation scenarios, patch details, and defensive guidance, but does not contain functional exploit code.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Windows DNSAPI.dll (Windows 11, Server 2022, Server 2025)
No auth needed
Prerequisites: Crafted DNS response · Unpatched Windows system
devstral-2 · analyzed May 15, 2026 Full analysis →
github WORKING POC
by m0n1x90 · cpoc
https://github.com/m0n1x90/CVE-2026-41096

This repository contains a functional proof-of-concept exploit for CVE-2026-41096, demonstrating a heap overflow in `DnsRawTruncateMessageForUdp()` via a crafted DNS response with `QDCOUNT=0` and a large OPT record. The exploit includes a rogue DNS server and a trigger client to confirm vulnerability.

Classification
Working Poc 100%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: Windows OS with vulnerable dnsapi.dll
No auth needed
Prerequisites: Python 3 for rogue server · Visual Studio/Windows SDK for trigger client · Admin/root for port 53
devstral-2 · analyzed May 24, 2026 Full analysis →
github WORKING POC
by satchfunky · cpoc
https://github.com/satchfunky/CVE-2026-41096-POC

This repository contains a functional PoC for CVE-2026-41096, targeting a vulnerability in the DnsQueryRaw function in Windows 11. The exploit involves a crafted DNS response with a malformed DNSRROPT record to trigger the bug.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: Windows 11 (specific versions)
No auth needed
Prerequisites: Network access to target · Scapy installed for Python script · Windows 11 environment
devstral-2 · analyzed May 24, 2026 Full analysis →
github SUSPICIOUS
by CryptReaper12 · poc
https://github.com/CryptReaper12/CVE-2026-41096

The repository claims to be a PoC for CVE-2026-41096 but lacks actual exploit code, instead redirecting users to an external download link (tinyurl.com). The README contains vague descriptions and no technical details about the vulnerability.

Classification
Suspicious 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: Microsoft Windows DNS
No auth needed
Prerequisites: Python 3.8+ · requests library · argparse library
devstral-2 · analyzed May 18, 2026 Full analysis →
github SUSPICIOUS
by ByteWraith1 · poc
https://github.com/ByteWraith1/CVE-2026-41096

The repository claims to provide a PoC for CVE-2026-41096, a critical heap-based buffer overflow in Microsoft Windows DNS, but only includes a README with vague details and a link to an external download (tinyurl). No actual exploit code is present.

Classification
Suspicious 95%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: Microsoft Windows DNS
No auth needed
Prerequisites: network access to vulnerable DNS server
devstral-2 · analyzed May 17, 2026 Full analysis →

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory patch
Windows DNS Client Remote Code Execution Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096

Scores

CVSS v3 9.8
EPSS 0.0004
EPSS Percentile 12.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-122
Status published
Products (14)
Microsoft/Windows 11 version 22H3 10.0.22631.0 - 10.0.22631.7079
Microsoft/Windows 11 Version 23H2 10.0.22631.0 - 10.0.22631.7079
Microsoft/Windows 11 Version 24H2 10.0.26100.0 - 10.0.26100.8457
Microsoft/Windows 11 Version 25H2 10.0.26200.0 - 10.0.26200.8457
Microsoft/Windows 11 version 26H1 10.0.28000.0 - 10.0.28000.2113
Microsoft/Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.0 - 10.0.25398.2330
Microsoft/Windows Server 2025 10.0.26100.0 - 10.0.26100.32860
Microsoft/Windows Server 2025 (Server Core installation) 10.0.26100.0 - 10.0.26100.32860
microsoft/windows_11_23h2 < 10.0.22631.7079 (2 CPE variants)
microsoft/windows_11_24h2 < 10.0.26100.8390 (2 CPE variants)
... and 4 more
Published May 12, 2026
Tracked Since May 12, 2026