Microsoft Flags Multiple DNS Vulnerabilities Across Windows DNS, BIND 9, and CoreDNS

Microsoft has published a cluster of DNS-related security advisories covering remote code execution, denial of service, cache poisoning, heap overflow, and access-control bypass conditions across Windows DNS Server and third-party DNS components. The newly listed issues include CVE-2026-33278 for possible arbitrary code execution during DNSSEC validation, CVE-2026-42959 for crashes triggered by malicious DNSSEC content, CVE-2026-42960 for possible cache poisoning through promiscuous authority-section records, and CVE-2026-42944 for a heap overflow involving multiple NSID, COOKIE, and PADDING EDNS options. Additional advisories describe degradation-of-service conditions tied to long EDNS option lists (CVE-2026-41292), unbounded name compression (CVE-2026-44390), and a "packet of death" affecting DNSCrypt (CVE-2026-32792).

The disclosures also reference flaws in widely used DNS software, including a BIND 9 resolver unbounded resend loop (CVE-2026-5950), invalid handling of CLASS != IN (CVE-2026-5946), and a CoreDNS ACL bypass (CVE-2026-26017). Earlier Microsoft advisories for Windows DNS Server remote code execution, including CVE-2021-33754 and CVE-2021-33746, show that DNS services remain a recurring high-impact target because they are network-exposed and central to enterprise operations. For defenders, the combined set of advisories highlights the need to prioritize patching DNS infrastructure, review exposure of DNSSEC, EDNS, and DNSCrypt features, and monitor for service instability or anomalous DNS responses that could indicate exploitation attempts.