0patch Releases Legacy Windows DNS Server Fixes for RCE Flaw CVE-2026-62878

0patch released micropatches for legacy Windows systems addressing CVE-2026-62878, a remote code execution vulnerability in Windows DNS Server. The flaw is a stack-based buffer overflow in recursive-query processing that allows an unauthenticated remote attacker, without special privileges, to cause memory corruption and potentially execute arbitrary code. Microsoft addressed the vulnerability in its August 2026 Windows updates by limiting query recursion nesting depth to 62.

Researchers Nicolas Alejandro Malizia and Joaquín Grassi subsequently published a proof of concept, allowing the micropatch developers to reproduce the vulnerability and create logically equivalent fixes for legacy systems. Organizations running Windows DNS Server should prioritize Microsoft's official updates where available and assess the applicability of 0patch's micropatches for legacy deployments that cannot receive the vendor fix. The public proof of concept increases the urgency of remediation, although the supplied reports do not establish active exploitation.