CVE-2026-62878 is a stack-based buffer overflow in Windows DNS Server. Microsoft rates it Critical with a CVSS score of 9.8 and describes remote code execution as a possible impact. During development of the Core Impact exploit, I could reproduce the underlying memory corruption and built a reliable remote denial-of-service path that requires no credentials or user interaction.
The trigger can be reproduced with a controlled DNS forwarder that returns deterministic cacheable responses (as described in this example).
I found a more direct path using ordinary public recursion and negative caching, without an attacker-controlled DNS server, custom delegation, Active Directory, or any special configuration on the target.
Test environment:
Windows Server 2025 with the DNS Server role, recursion enabled, and Internet DNS resolution available. Behavior can differ across builds, cache states, and network configurations.
File version:
dns.exe = 10.0.26100.32995 MD5 34ABA4D2255F479468E6CD7EE35CDA88
NTree organization:
Windows DNS uses an internal name-tree structure, commonly referred to as NTree, to organize cached and authoritative names. Each node represents a stored name component. A node can have child nodes, and those children initially form a searchable sibling structure.
When a sibling group becomes large, Windows DNS converts it into a hash node. A hash maps each child to an index, while a bucket holds the smaller group of nodes assigned to that index. Under normal conditions, different label bytes distribute nodes across multiple buckets and keep lookups efficient.
Hash inconsistency:
DNS labels carry an explicit length, so a label may contain a zero byte as data. The vulnerable behavior appears because two internal operations interpret that label differently.
Dns_DowncaseNameLabel() preserves the label according to its explicit length. The hash walk in NTree_FindOrCreateChildNodeEx(), however, stops when it encounters the first NUL byte. Consequently, labels such as ‘\x00aaa’, ‘\x00aab’, and ‘\x00aac’ compare as different nodes but produce the same hash result.
Every NUL-first label selects bucket 0. The nodes remain distinct, yet the hash table cannot distribute them.
After a sibling group or bucket reaches 64 nodes, NTree_CreateHashAtNode() promotes that group into another hash level. Because the next hash walk sees the same leading NUL, all nodes again select bucket 0. Repeating this process produces nested hash levels without reducing the concentrated sibling chain.
Stack corruption and demonstrated impact:
During promotion, NTree_CreateHashAtNode() flattens the sibling chain into a local array with space for 500 node pointers. The traversal routine receives the array address but not its capacity. It writes each node pointer and then appends a terminating NULL.
At the boundary, the array is already full when the terminator is written. The extra write moves beyond the stack allocation and corrupts adjacent data, including the stack cookie.
This primitive reliably produces a DoS, but it does not currently provide reproducible code execution. The overflow writes pointers to existing NTree nodes rather than attacker selected bytes. More importantly, the stack cookie is corrupted before the saved return address can be used. The integrity check detects the modification and terminates “dns.exe”.
Patch behavior:
Our diff comparison identified a depth check in NTree_AddNodeInHashBucket(). When the security feature is enabled and the nested hash depth reaches 0x3E, the function takes a safe return path instead of calling NTree_CreateHashAtNode() again.
The check prevents the recursive promotion pattern from continuing indefinitely. The malformed labels may still collide, but the chain can no longer force the vulnerable conversion at progressively deeper hash levels.
Administrators should install the applicable Microsoft security update or a superseding cumulative update. Network restrictions can reduce exposure while updates are deployed, but they do not protect against a vulnerable resolver from clients already permitted to send DNS queries.
