{"id":"CVE-2026-96112","aliases":[],"cve":{"records":[{"id":"CVE-2026-96112","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T18:19:24.217Z","published":"2026-11-10T18:16:28.521Z","modified":"2026-11-13T18:05:20.272Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-11-13T18:05:20.272Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-11T01:17:25.320Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96112","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-125","description":"CWE-125: Out-of-bounds Read","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.14393.0","versionEndExcluding":"10.0.14393.9688"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.14393.0","versionEndExcluding":"10.0.14393.9688"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.17763.0","versionEndExcluding":"10.0.17763.9487"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.17763.0","versionEndExcluding":"10.0.17763.9487"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.20348.0","versionEndExcluding":"10.0.20348.5870"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.33822"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.33822"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-11T01:15:41.175367Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Windows DNS Server Information Disclosure Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Out-of-bounds read in DNS Server allows an authorized attacker to disclose information locally.","score":5.5,"severity":"medium","published":"2026-11-10T18:16:28.521Z","modified":"2026-11-13T18:05:20.272Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Windows Server 2016","platforms":["x64-based Systems"],"versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.9688","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-96112"},{"vendor":"Microsoft","name":"Windows Server 2016 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.9688","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-96112"},{"vendor":"Microsoft","name":"Windows Server 2019","platforms":["x64-based Systems"],"versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.9487","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-96112"},{"vendor":"Microsoft","name":"Windows Server 2019 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.9487","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-96112"},{"vendor":"Microsoft","name":"Windows Server 2022","platforms":["x64-based Systems"],"versions":[{"version":"10.0.20348.0","status":"affected","lessThan":"10.0.20348.5870","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-96112"},{"vendor":"Microsoft","name":"Windows Server 2025","platforms":["x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.33822","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-96112"},{"vendor":"Microsoft","name":"Windows Server 2025 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.33822","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-96112"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96112"],"sources":[{"name":"CVE","id":"CVE-2026-96112","modified":"2026-11-13T18:05:20.272Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-96112"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","score":5.5}],"sourceAffected":[],"observedAt":"2026-11-13T19:28:29.921Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T21:20:32.434Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-11T03:05:30.501Z","attemptedAt":"2026-11-11T03:05:30.501Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-11T03:05:30.501Z","attemptedAt":"2026-11-11T03:05:30.501Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-11T03:05:30.501Z","attemptedAt":"2026-11-11T03:05:30.501Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-11T03:05:30.501Z","attemptedAt":"2026-11-11T03:05:30.501Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-121483","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-121483","modified":"Nov 11, 2026, 1:17:25 AM","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","checkedAt":"2026-11-11T03:05:30.501Z"},{"source":"GitHub Advisory Database","id":"GHSA-94g2-v7m7-7c6g","url":"https://github.com/advisories/GHSA-94g2-v7m7-7c6g","modified":"2026-11-10T21:34:24Z","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-11T03:05:30.501Z"},{"source":"NVD","id":"CVE-2026-96112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96112","modified":"2026-11-11T02:17:22.050","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-11T03:05:30.501Z"}],"aiSummary":{"text":"An out-of-bounds read in Windows DNS Server allows an authorized attacker to disclose information locally, affecting Windows Server 2016, 2019, 2022, and 2025 versions prior to specific updates. The weakness is classified as CWE-125: Out-of-bounds Read.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-11T03:01:09.746Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-96112"}]}}