CVE-2026-49169
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Use-After-Free vulnerability in DNS Server allows an authorized attacker to execute code remotely over the network. The issue stems from improper memory management when processing specially crafted DNS queries.
Risk Assessment
An attacker could take control of the DNS server, leading to potential network traffic interception, data leakage, or further escalation within the infrastructure.
Recommendation
Apply the security update provided by the operating system or DNS software vendor immediately. If a patch is unavailable, restrict DNS server access to trusted networks only.
Other vulnerabilities in DNS Server
See all- CVE-2026-96113Critical
A heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. The vulnerability stems from improper memory handling during DNS query processing.
- CVE-2026-83869Critical
Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.
- CVE-2016-3227Critical
A use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests.
- CVE-2026-97844Medium
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
- CVE-2026-97843Medium
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
- CVE-2026-97842Medium
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
- CVE-2026-97841Medium
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
- CVE-2026-97840Medium
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
- CVE-2026-97839Medium
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
- CVE-2026-97838Medium
An out-of-bounds read vulnerability in the DNS Server allows an authorized attacker to disclose information over a network.
Original NVD description (English source)
Use after free in DNS Server allows an authorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS