CVE-2026-41108: Windows DNS Client Elevation of Privilege Vulnerability

Synopsis

A heap-based buffer overflow in the Microsoft Windows DNS client allows a local attacker to elevate privileges on the affected host. The vulnerability is reachable locally and requires a low-privilege account; no interaction from another user is needed. Successful exploitation gives the attacker full control over the host, including the ability to read, modify, or destroy any data and crash running services. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to attempt exploitation; no administrative credentials are needed.

• Victim interactionNot required

  The attacker can trigger the overflow entirely on their own without any action from another user.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must meet specific conditions such as timing constraints, memory layout requirements, or other environmental factors that are not always guaranteed.

Blast Radius

• A successful attacker gains full read access to all data on the host, including credentials, session tokens, and application secrets stored in memory or on disk.
• The attacker can write or modify any file and data on the system, including security policy configuration and audit logs.
• The attacker can terminate or crash any running process or service on the host, causing a local denial of service.
• Because all three impact dimensions are rated High, the attacker effectively achieves full local system compromise from a standard user account.