Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow (CWE-122) in the Windows DNS client dnsapi.dll DNS-response UDP-truncation path, unauthenticated remote code execution (Critical, AV:N, CVSS 9.8). When the DNS client processes a response and prepares/truncates the message for UDP, DnsRawTruncateMessageForUdp relocates the OPT (EDNS0) record within the message buffer via memmove(_Dst, source, length) and recomputes the message length. PRE: the destination/source pointer relationship and the moved length were not adequately bounded, so a crafted DNS response (attacker-controlled record layout / OPT record) could drive the memmove to write past the heap message buffer - a heap overflow. Because the DNS client parses responses received over the network with no authentication, this is a remote code-execution primitive (Microsoft rates it Critical 9.8). Diff of dnsapi.dll 10.0.26100.8328 -> .8457 (May 12 2026, KB5089549) confirms the fix: gated behind CFR flag Feature_2032384314, DnsRawTruncateMessageForUdp adds validation before the OPT-record move - it checks the source/destination pointer relationship (local_48 < _Dst) and bounds the recomputed offset/length to below 0x10000 (if (pbVar4 < 0x10000) ...) before setting the truncated length, so the move and length can no longer overflow the buffer.

A crafted DNS response drives an unbounded OPT-record memmove during UDP truncation, overflowing the heap message buffer

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

WARP team at Microsoft