Micropatches released for Windows DNS Server Remote Code Execution Vulnerability (CVE-2026-62878)
August 2026 Windows Updates brought a patch for CVE-2026-62878, a remote code execution vulnerability in Windows DNS Server, allowing an attacker to remotely cause memory corruption on the DNS server without authentication or special privileges. According to Microsoft's advisory, such memory corruption could be used for arbitrary code execution.
Subsequently, security researchers Nicolas Alejandro Malizia and Joaquín Grassi published their own proof of concept, which allowed us to reproduce the issue and create patches for legacy Windows systems.
The Vulnerability
This is a stack-based buffer overflow in Windows DNS Server, caused by flawed code processing a recursive query. Read Nicolas and Joaquín's analysis for more details.
Microsoft's Patch
Microsoft fixed this issue by limiting the query recursion nesting depth to 62, effectively preventing the overflow.
Our Patch
Our patch is logically identical to Microsoft's.
Let's see our patch in action. Windows Server with a vulnerable DNS Server (computer on the left) is accessible on the network. Attacker (computer on the right) runs an exploit script that sends a large number of malicious requests to the vulnerable DNS server.
With 0patch disabled, the vulnerable DNS Server crashes with memory access violation.
With 0patch enabled, the DNS Server does not crash.
Micropatch Availability
Micropatches were written for the following security-adopted Windows versions:
Windows Server 2008 R2 - fully updated with no ESU, with ESU 1, ESU 2, ESU 3 or ESU 4
Windows Server 2012 - fully updated with no ESU, with ESU 1 or ESU2
Windows Server 2012 R2 - fully updated with no ESU, with ESU 1 or ESU2
Micropatches have already been distributed to, and applied on, all affected online computers with 0patch Agent in PRO or Enterprise accounts (unless Enterprise group settings prevented that).
Vulnerabilities like these get discovered on a regular basis, and attackers know about them all. If you're using Windows that aren't receiving official security updates anymore, 0patch will make sure these vulnerabilities won't be exploited on your computers - and you won't even have to know or care about these things.
We'd like to thank Nicolas Alejandro Malizia and Joaquín Grassi for sharing their proof-of-concept, which allowed us to create patches for Windows versions that are no longer receiving official updates from Microsoft.
If you're new to 0patch, create a free account in 0patch Central, start a free trial, then install and register 0patch Agent. Everything else will happen automatically. No computer reboot will be needed.
Did you know 0patch security-adopted Windows 10 and Office 2016 and 2019 when they went out of support in October 2025, allowing you to keep using them for at least 3 more years (5 years for Windows 10)? Read more about it here and here.
Note that we are security-adopting the following products soon:
Windows 10 22H2 with Extended Security Updates year 1: October 2026
Windows Server 2012 with Extended Security Updates year 3: October 2026
Windows Server 2012 R2 with Extended Security Updates year 3: October 2026
Microsoft Office 2021: October 2026
Windows 11 23H2 (E): November 2026
Windows Server 2016: January 2027
To learn more about 0patch, please visit our Help Center.