CVE-2026-88122: CWE-125: Out-of-bounds Read in Microsoft Windows Server 2012

CVE-2026-88122 is a vulnerability classified as CWE-125 (Out-of-bounds Read) found in the DNS Server of Microsoft Windows Server 2012 and related versions. It permits an authorized attacker to trigger a denial of service condition remotely by exploiting improper memory handling. The vulnerability affects Windows Server versions from 6.2.9200.0 up to but not including 6.2.9200.26434, 6.3.9600.0 up to but not including 6.3.9600.23470, 10.0.14393.0 up to but not including 10.0.14393.9612, 10.0.17763.0 up to but not including 10.0.17763.9376, 10.0.20348.0 up to but not including 10.0.20348.5761, and 10.0.26100.0 up to but not including 10.0.26100.33650. The vulnerability does not impact confidentiality or integrity but impacts availability by causing denial of service. Microsoft has released an official fix to address this issue.

The vulnerability allows an authorized attacker to cause a denial of service (DoS) on affected Windows Server systems by exploiting an out-of-bounds read in the DNS Server. There is no impact to confidentiality or integrity. The attack vector is network-based with low attack complexity and requires privileges (PR:L). No user interaction is needed. The overall impact is disruption of service availability.

An official fix is available from Microsoft to remediate this vulnerability. Administrators should apply the security updates provided by Microsoft for the affected Windows Server versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88122. No additional mitigation steps are indicated by the vendor advisory.