# CVE-2026-41096 — Windows DNS Client `dnsapi.dll` Unbounded OPT-Record Relocation in `DnsRawTruncateMessageForUdp` → Heap Buffer Overflow (RCE)

---

## Summary

| | |
|---|---|
| **Product** | Windows — `dnsapi.dll` (Windows DNS Client) |
| **CVE ID** | CVE-2026-41096 |
| **Impact** | Remote Code Execution (unauthenticated, network) |
| **MSRC severity** | Critical |
| **CVSS** | 9.8 / 8.5 — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-122: Heap-based Buffer Overflow |
| **Delivery** | Network — a crafted DNS response to the client (no auth, no interaction) |
| **KB / Fixed build** | KB5089549 — `dnsapi.dll` 10.0.26100.8457 (Win11 24H2 x64) |
| **Patch Date** | May 12, 2026 (2026-May) |
| **Pre-patch binary** | `dnsapi.dll` 10.0.26100.8328 — SHA256 `3cc0796f0a0acfcbae892f82a36ece4aad30b0f0afa2c9a85b39dff04e7f094b` |
| **Post-patch binary** | `dnsapi.dll` 10.0.26100.8457 — SHA256 `f00e35d79d4fea4d6ed3964c9a57f3306db75bd83afc92b619778b9b1d0ce3d9` |
| **Feature flag** | `Feature_2032384314` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Unlikely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`dnsapi.dll` is the Windows DNS Client library, which parses DNS responses received
over the network. When a response must be represented/truncated for UDP,
`DnsRawTruncateMessageForUdp` rewrites the message in place — including relocating
the **OPT (EDNS0) record** within the message buffer with `memmove` — and recomputes
the truncated message length.

---

## Vulnerability Summary

Pre-patch, the OPT-record relocation in `DnsRawTruncateMessageForUdp` did not
adequately bound the source/destination pointer relationship or the moved length. A
crafted DNS response (attacker-controlled record layout / OPT record) could drive the
`memmove` to write past the end of the heap message buffer and store an out-of-range
truncated length — a heap buffer overflow (CWE-122). Because the DNS client parses
responses received **over the network without authentication**, this is a remote
code-execution primitive; Microsoft rates it Critical (CVSS 9.8).

---

## Prerequisites and Constraints

- Network, unauthenticated (`AV:N`, `PR:N`, `UI:N`): the attacker sends a crafted DNS
  response to the target's DNS client (e.g. as/via a DNS server or an on-path
  responder).
- Shape the response records / OPT record so the truncation relocation computes an
  out-of-bounds destination or length.
- Result: the heap message buffer overflows during UDP truncation.

---

## Vulnerability Details

### Root Cause

The OPT/EDNS0 record move performed while truncating a response for UDP used a
destination/length derived from the (attacker-influenced) message layout without
bounding it against the buffer, so a crafted response overflowed the heap buffer.

### The patch (confirmed — diff, .8328 → .8457)

Gated behind `Feature_2032384314`, `DnsRawTruncateMessageForUdp` adds validation
around the OPT-record move and the truncated-length computation:

```c
// DnsRawTruncateMessageForUdp (10.0.26100.8457) — PATCHED, feature-enabled branch (from our diff)
uVar1 = DnsRawFindOptRecord(param_1, &local_48, local_50);
if (Feature_2032384314__private_IsEnabledDeviceUsageNoInline() && (local_48 < _Dst)) {
    // validated source/destination relationship before moving the OPT record
}
memmove(_Dst, local_48, (ulonglong)local_50[0]);
...
pbVar4 = _Dst + (-700 - param_1);
if (pbVar4 < (byte *)0x10000) {                 // *** bound the recomputed offset/length ***
    if ((byte *)(ulonglong)param_2 < pbVar4) { ... }
    *(short *)(param_1 + 0x2ba) = (short)pbVar4; // store bounded truncated length
}
```

With the source/destination relationship validated (`local_48 < _Dst`) and the
recomputed offset/length bounded below `0x10000`, the OPT-record move and the stored
length can no longer exceed the buffer, closing the overflow.

### Patch Completeness Assessment

**CFR-gated behind `Feature_2032384314`.** The bounds checks run only when the flag
is enabled; the original unbounded path still ships when disabled. Verify
`Feature_2032384314` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** DNS responses with anomalous record/OPT (EDNS0) layouts that trigger
UDP truncation handling; heap-overflow / crash telemetry in
`dnsapi!DnsRawTruncateMessageForUdp` on unpatched/flag-disabled builds. Prefer
DNS-over-TCP/DoH and validate resolvers where feasible.

**Config.** The fix is CFR-gated — confirm `Feature_2032384314` is enabled.

---

## References

- MSRC advisory — CVE-2026-41096 (Windows DNS Client Remote Code Execution), released 2026-05-12, KB5089549.
- Full binary diff: `/data/patch_diffs/dnsapi_dll-cve-2026-41096-ghidriff.md`