CVE-2026-70155

Analyzed Analyzed - Analysis Complete

Memory Leak in Windows DNS Server

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Microsoft Corporation

Description

Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70155

EUVD

EUVD-2026-99180

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_server_2012	r2
microsoft	windows_server_2012	*
microsoft	windows_10_1607	to 10.0.14393.9612 (exc)
microsoft	windows_10_1607	to 10.0.14393.9612 (exc)
microsoft	windows_10_1809	to 10.0.17763.9376 (exc)
microsoft	windows_10_1809	to 10.0.17763.9376 (exc)
microsoft	windows_server_2016	to 10.0.14393.9612 (exc)
microsoft	windows_server_2019	to 10.0.17763.9376 (exc)
microsoft	windows_server_2025	to 10.0.26100.33650 (exc)
microsoft	windows_server_2022	to 10.0.20348.5761 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability involves a missing release of memory after its effective lifetime in Windows DNS. An unauthorized attacker can exploit this to deny service over a network by causing a system to run out of available memory.

Impact Analysis

This vulnerability can lead to a denial of service, making systems unavailable to users. If exploited, it could disrupt network services relying on Windows DNS, causing downtime and loss of access to critical applications.

Compliance Impact

This vulnerability causes a denial of service over a network, which could disrupt critical services. For GDPR, it may impact availability of personal data processing systems. For HIPAA, it could affect the availability of protected health information systems. Compliance may be impacted if service disruptions lead to unauthorized access or data breaches.

Mitigation Strategies

Apply the latest Windows security updates from Microsoft Update to patch the DNS memory release issue. Monitor network traffic for unusual DNS service disruptions.

Hi! I’m here to help you understand CVE-2026-70155. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70