CVE-2026-49175

What it actually does

This is a local privilege-escalation vulnerability caused by a heap-based buffer overflow in Windows DNS components. An attacker who already has a valid low-privileged local account can trigger unsafe memory handling and potentially execute code with elevated privileges, likely in the security context of the affected DNS-related service or process. The CVSS vector indicates local access, low attack complexity, no user interaction, and high confidentiality, integrity, and availability impact once exploited.

Why it matters to the business

Successful exploitation can turn a limited Windows account compromise into full system compromise, allowing attackers to disable security tools, steal sensitive data, install persistence, move laterally, or disrupt critical Windows services. The risk is highest on shared workstations, jump hosts, servers, DNS infrastructure, and systems where local account compromise is plausible. This issue is not currently listed in CISA KEV, has low EPSS, and has no reported mature public exploit, but privilege-escalation flaws are commonly chained with phishing, credential theft, remote-code-execution, and ransomware intrusions.

How an attack unfolds

An attacker first obtains local authenticated access to an affected Windows system, such as through stolen credentials, malware execution, remote desktop access, or exploitation of another vulnerability. From that foothold, the attacker runs a crafted local program or sends crafted input to the vulnerable Windows DNS component to corrupt heap memory. If exploitation is reliable, the attacker controls execution flow or manipulates process memory to run code with elevated privileges. After elevation, the attacker may create administrative users, dump credentials, tamper with security controls, install persistence, access protected files, or use the host as a staging point for lateral movement. Because exploit maturity is currently reported as none and EPSS is low, exploitation may require custom development, but the low-complexity local vector makes it important to patch as part of regular Windows security update cycles.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-49175 for all affected Windows versions, including Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025. No specific fixed build numbers were provided in the input, so use Microsoft Update, WSUS, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog to deploy the latest cumulative security updates for the relevant Windows release. Prioritize systems that provide DNS services, administrative workstations, servers exposed to many users, remote access hosts, and high-value endpoints. If immediate patching is not possible, reduce local logon rights, restrict interactive access to servers, enforce least privilege, monitor for suspicious local privilege-escalation behavior, and ensure endpoint detection controls are active. There is no complete mitigation equivalent to applying the vendor patch.

How to confirm the fix worked

Confirm that each affected Windows system has installed the cumulative security update that includes the fix. Validate using Windows Update history, PowerShell Get-HotFix, Microsoft Defender Vulnerability Management, WSUS/Configuration Manager/Intune compliance reports, or authenticated vulnerability scanning. Confirm that the OS build and patch level match Microsoft’s fixed release for the applicable Windows version. For exposure validation, inventory all Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 assets and identify systems missing the relevant July 2026 or later security update. Where feasible, verify that DNS-related services continue to operate normally after patching and review event logs for crashes or abnormal behavior before and after remediation.

Typical attack path

1. Gain initial access to an affected Windows workstation or server using valid credentials, malware, remote access, or another vulnerability.
2. Establish execution as a low-privileged local user.
3. Run a crafted exploit or tool that interacts with the vulnerable Windows DNS component and triggers the heap-based buffer overflow.
4. Achieve elevated code execution or privilege escalation on the local system.
5. Disable defenses, dump credentials, modify DNS or network settings, create persistence, or move laterally to other systems.

How to detect it

To determine whether exploitation may already have occurred, review endpoint and Windows event telemetry for local privilege-escalation behavior rather than relying on a single definitive indicator. Useful sources include Windows Security logs, Sysmon, EDR process telemetry, Windows Error Reporting, Application logs, System logs, PowerShell logs, service control logs, and DNS Server logs where applicable. Look for DNS-related process crashes followed shortly by privileged process creation, new local administrator accounts, changes to local group membership, credential dumping tools, LSASS access, security tool tampering, or unexpected service creation. On DNS servers, investigate abnormal termination or restart of DNS services, suspicious processes spawned from DNS-related service contexts, and administrative changes made immediately after crashes. Because no public exploit signature or threat-actor-specific campaign is identified in the input, detections should focus on exploit side effects: memory corruption crashes, privilege transitions, suspicious child processes, persistence creation, and post-exploitation actions.

• Application Error
• Windows Error Reporting
• Faulting application name: dns.exe
• Faulting application name: svchost.exe
• Faulting module name: dnsapi.dll
• Faulting module name: dnsrslvr.dll
• Faulting module name: dns.exe
• The DNS Server service terminated unexpectedly
• Service Control Manager
• Event ID 1000
• Event ID 1001
• Event ID 7031
• Event ID 7034
• Event ID 4688
• Event ID 4672
• Event ID 4720
• Event ID 4732
• Event ID 7045
• vssadmin.exe delete shadows
• wevtutil.exe cl
• rundll32.exe comsvcs.dll, MiniDump
• procdump.exe -ma lsass.exe
• reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• net localgroup administrators

What your security team should do

• Patch affected Windows endpoints and servers through the normal emergency or high-priority Windows security update process, with priority on servers, DNS infrastructure, privileged access workstations, and shared-user systems.
• Inventory affected Windows versions and use authenticated scanning or endpoint management telemetry to identify systems missing the relevant cumulative update.
• Hunt for signs of local privilege escalation, including unusual child processes, service crashes, new local administrators, credential dumping, and defense tampering after low-privileged user activity.
• Restrict local interactive logon and RDP access to servers, especially DNS servers and high-value systems.
• Enforce least privilege and remove unnecessary local administrator rights to reduce the value of exploitation.
• Monitor Microsoft advisories for fixed build details, exploitability updates, and any change in public exploit maturity or KEV status.
• Ensure EDR, PowerShell logging, process creation auditing, and Windows Error Reporting telemetry are enabled on high-value Windows systems.