Critical Windows DNS Client Flaw Enables Remote Code Execution
ID: 56c64ea0-3518-501d-8a2f-a2bc97403b03
STIX ID: report--56c64ea0-3518-501d-8a2f-a2bc97403b03
Feed Name: Cyber Press
Threat Score
CVE-2026-41096 is a critical (CVSS 9.8) heap-based buffer overflow in the Windows DNS Client (DNSAPI.dll) that allows unauthenticated, no-click remote code execution via malicious DNS responses across Windows 11, Windows Server 2022, and Windows Server 2025; Microsoft released a patch on May 12, 2026, and defenders are urged to apply updates immediately or restrict DNS to trusted resolvers and monitor for anomalous child processes.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.