Microsoft Windows DNS Server NTree Cache Remote DoS (CVE-2026-62878)

CVE-2026-62878 is a stack-based buffer overflow in Microsoft Windows DNS Server. NUL-first DNS labels collide in one NTree cache bucket until a fixed-size stack array is exceeded, corrupting the stack cookie and terminating dns.exe. An unauthenticated remote attacker can exploit this behavior to cause a denial of service. This module performs the following steps: 1. Confirms that the target recursively resolves random names below a public domain and records baseline UDP and TCP availability. 2. Sends a DNS query containing a NUL-first label and verifies that the target returns a non-authoritative NXDOMAIN or NODATA response. 3. Sends 600 unique ASCII-safe NUL-first names so distinct negative-cache nodes accumulate in the same NTree bucket. 4. Waits briefly, then probes every DNS transport that worked before the trigger and records whether the DNS service became unavailable.