CVE-2026-70074: Windows DNS Information Disclosure Vulnerability

Let us break down the exact technical specifications, affected Windows editions, official Microsoft security patches, and why even a seemingly minor out-of-bounds read deserves a permanent spot on your patch management checklist.

Technical Overview and Vulnerability Metrics​

At the core of CVE-2026-70074 is an out-of-bounds read weakness classified under CWE-125. According to Microsoft's official description:

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information locally.

Click to expand...

To help administrators prioritize their patching cadence, MSRC has provided the following official metrics and status indicators for CVE-2026-70074:

• CVE ID: CVE-2026-70074
• Title: Windows DNS Information Disclosure Vulnerability
• Severity: Important
• CVSS Base Score: 5.5
• CVSS Temporal Score: 4.8
• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
• Weakness (CWE): CWE-125
• Exploitation Assessment: Exploitation Unlikely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Official Advisory Facts​

Microsoft's official advisory highlights two specific facts regarding the nature and scope of this flaw:

• Windows DNS Information Disclosure Vulnerability: Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information locally.
• FAQ-Information Disclosure - Kernel Memory: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is one byte of kernel memory could be leaked back to the attacker.

Section Summary: CVE-2026-70074 is an Important-severity local information disclosure flaw (CVSS 5.5 base, 4.8 temporal) rooted in an out-of-bounds read (CWE-125) within Windows DNS that can leak one byte of kernel memory to an authorized local attacker.

Why One Byte of Kernel Memory Matters: Expert Analysis​

Wait a minute—why would Microsoft issue patches across six generations of Windows Server and two Windows 10 builds over one single byte of kernel memory? If you have ever debugged a memory boundary issue or studied how modern operating system defenses work, the answer becomes crystal clear.

Synthesizing from general industry knowledge of Windows kernel architecture, the kernel space is strictly segregated from user-mode applications to protect system stability and sensitive operating system structures. When a program or service suffers from an out-of-bounds read (CWE-125), it reads past the intended buffer boundary in memory. Even when an individual read operation only returns a single byte of uninitialized or adjacent kernel memory, two critical factors come into play for enterprise defenders:

1. Repeatable Probing: What happens if a local low-privileged process triggers the vulnerable code path repeatedly? Depending on how memory is allocated and aligned, an attacker who is already authenticated locally (AV:L/PR:L) and requires no user interaction (UI:N) may attempt to infer state information or defeat kernel memory protections by observing leaked byte values.
2. Defense-in-Depth on Infrastructure Servers: Notice the product footprint for CVE-2026-70074. It covers every major Windows Server release from Windows Server 2012 through Windows Server 2025, as well as Windows 10 Version 1607 and Windows 10 Version 1809. Domain Name System (DNS) servers are frequently colocated with Active Directory Domain Controllers or critical core network infrastructure. Leaving any kernel memory leak unpatched on high-value servers violates fundamental defense-in-depth principles.

On the bright side, MSRC assesses the flaw as Exploitation Unlikely, with Publicly disclosed: No and Exploited: No. Furthermore, the CVSS vector confirms there is no direct impact to system integrity (I:N) or availability (A:N), meaning this flaw cannot modify data or trigger a Blue Screen of Death on its own. Still, with Customer action required: Yes, installing the official cumulative updates is the right operational call.

Section Summary: While CVE-2026-70074 cannot remotely compromise a system or directly alter kernel memory, patching out-of-bounds read flaws is essential to maintain kernel isolation and protect core Windows infrastructure against local reconnaissance.

Affected Products, KB Updates, and Fixed Builds​

Microsoft has released six distinct Knowledge Base (KB) updates—KB5126868, KB5126651, KB5126835, KB5126836, KB5126655, and KB5126646—to address CVE-2026-70074 across 16 affected Windows product editions. Note that Windows 10 Version 1607 shares its update package and fixed build with Windows Server 2016, while Windows 10 Version 1809 shares its update package and fixed build with Windows Server 2019.

Below is the complete, exact mapping of affected products, KB articles, and vendor fixed build versions:

Official Remediation Guidance​

To fully remediate CVE-2026-70074, administrators should apply the corresponding security update for each affected installation in their environment:

• For Windows 10 Version 1607 for 32-bit Systems (x86), install KB5126868 to reach fixed build 10.0.14393.9612.
• For Windows 10 Version 1607 for x64-based Systems, install KB5126868 to reach fixed build 10.0.14393.9612.
• For Windows 10 Version 1809 for 32-bit Systems (x86), install KB5126651 to reach fixed build 10.0.17763.9376.
• For Windows 10 Version 1809 for x64-based Systems, install KB5126651 to reach fixed build 10.0.17763.9376.
• For Windows Server 2012 (Server Core installation) (x64), install KB5126835 to reach fixed build 6.2.9200.26434.
• For Windows Server 2012 (x64), install KB5126835 to reach fixed build 6.2.9200.26434.
• For Windows Server 2012 R2 (Server Core installation) (x64), install KB5126836 to reach fixed build 6.3.9600.23470.
• For Windows Server 2012 R2 (x64), install KB5126836 to reach fixed build 6.3.9600.23470.
• For Windows Server 2016 (Server Core installation) (x64), install KB5126868 to reach fixed build 10.0.14393.9612.
• For Windows Server 2016 (x64), install KB5126868 to reach fixed build 10.0.14393.9612.
• For Windows Server 2019 (Server Core installation) (x64), install KB5126651 to reach fixed build 10.0.17763.9376.
• For Windows Server 2019 (x64), install KB5126651 to reach fixed build 10.0.17763.9376.
• For Windows Server 2022 (Server Core installation) (x64), install KB5126655 to reach fixed build 10.0.20348.5761.
• For Windows Server 2022 (x64), install KB5126655 to reach fixed build 10.0.20348.5761.
• For Windows Server 2025 (Server Core installation) (x64), install KB5126646 to reach fixed build 10.0.26100.33650.
• For Windows Server 2025 (x64), install KB5126646 to reach fixed build 10.0.26100.33650.

Practical Verification Steps for Windows Administrators​

Once you have deployed the appropriate update package across your Windows Server or Windows 10 fleet, verifying compliance is straightforward:

1. Verify Installed KB Package: Run Get-HotFix -Id KB5126646, KB5126655, KB5126651, KB5126868, KB5126836, KB5126835 in an elevated PowerShell prompt to confirm that the relevant patch for your operating system is present.
2. Confirm the Fixed OS Build Number: Check the operating system build version to ensure the update has completed its servicing stack commit and any required system reboot. Match your system's current build number directly against the target builds listed above (10.0.14393.9612, 10.0.17763.9376, 6.2.9200.26434, 6.3.9600.23470, 10.0.20348.5761, or 10.0.26100.33650).
3. Audit Local Access on DNS Hosts: Because CVE-2026-70074 requires local authenticated privileges (AV:L/PR:L), restricting interactive and non-essential local logons on Windows Server systems—particularly those running Server Core or full desktop installations in production—provides an immediate layer of operational risk reduction while your maintenance windows roll out.

Section Summary: Administrators must install the designated KB update for their specific Windows 10 or Windows Server platform to reach the verified fixed build and eliminate the CVE-2026-70074 kernel memory disclosure risk.