Micropatches released for Windows DNS Server Remote Code Execution Vulnerability (CVE-2026-62878)

August 2026 Windows Updates brought a patch for CVE-2026-62878 , a remote code execution vulnerability in Windows DNS Server, allowing an attacker to remotely cause memory corruption on the DNS server without authentication or special privileges. According to Microsoft's advisory, such memory corruption could be used for arbitrary code execution.

Subsequently, security researchers Nicolas Alejandro Malizia and Joaquín Grassi published their own proof of concept , which allowed us to reproduce the issue and create patches for legacy Windows systems.

This is a stack-based buffer overflow in Windows DNS Server, caused by flawed code processing a recursive query. Read Nicolas and Joaquín's analysis for more details.

Microsoft fixed this issue by limiting the query recursion nesting depth to 62, effectively preventing the overflow.

Our patch is logically identical to Microsoft's. Let's see our patch in action. Windows Server with a vulnerable DNS Server (computer on the left) is accessible on the network. Attacker (computer on the right) runs an exploit script that sends a large number of malicious requests to the vulnerable DNS server.

With 0patch disabled, the vulnerable DNS Server crashes with memory access violation.

With 0patch enabled, the DNS Server does not crash.

Micropatch Availability

Micropatches were written for the following security-adopted Windows versions:

Windows Server 2008 R2 - fully updated with no ESU, with ESU 1, ESU 2, ESU 3 or ESU 4

Windows Server 2008 R2 - fully updated with no ESU, with ESU 1, ESU 2, ESU 3 or ESU 4

Windows Server 2012 - fully updated with no ESU, with ESU 1 or ESU2

Windows Server 2012 - fully updated with no ESU, with ESU 1 or ESU2

Windows Server 2012 R2 - fully updated with no ESU, with ESU 1 or ESU2

Windows Server 2012 R2 - fully updated with no ESU, with ESU 1 or ESU2

Micropatches have already been distributed to, and applied on, all affected online computers with 0patch Agent in PRO or Enterprise accounts (unless Enterprise group settings prevented that).

Vulnerabilities like these get discovered on a regular basis, and attackers know them all. If you're using Windows that aren't receiving official security updates anymore, 0patch will make sure these vulnerabilities won't be exploited on your computers - and you won't even have to know or care these things.

We'd like to thank Nicolas Alejandro Malizia and Joaquín Grassi for sharing their proof-of-concept, which allowed us to create patches for Windows versions that are no longer receiving official updates from Microsoft.

If you're new to 0patch, create a free account in 0patch Central , start a free trial, then install and register 0patch Agent. Everything else will happen automatically. No computer reboot will be needed.

Note that we are security-adopting the following products soon:

Windows 10 22H2 with Extended Security Updates year 1: October 2026

Windows 10 22H2 with Extended Security Updates year 1: October 2026

Windows Server 2012 with Extended Security Updates year 3: October 2026

Windows Server 2012 with Extended Security Updates year 3: October 2026

Windows Server 2012 R2 with Extended Security Updates year 3: October 2026

Windows Server 2012 R2 with Extended Security Updates year 3: October 2026

Microsoft Office 2021: October 2026

Microsoft Office 2021: October 2026

Windows 11 23H2 (E): November 2026

Windows 11 23H2 (E): November 2026

Windows Server 2016: January 2027

Windows Server 2016: January 2027