CVE-2026-50487 is a use after free (CWE-416) in Windows DNS that allows an unauthorized attacker to elevate privileges over a network, per NVD. It is scored 8.1 high. The record lists Windows 11 and Windows Server 2025 builds. Install the Microsoft update for your build.
What's affected
The record lists Windows 11 24H2, 25H2 and 26H1, and Windows Server 2025. The description says only Windows DNS, so read Microsoft's advisory to see whether the client or the server role is the target for your systems.
The vector is network based, high complexity, with no privileges or user interaction. No update number is in the record.
How to check if you're exposed
On Windows Server, check whether the DNS Server role is installed:
Get-WindowsFeature DNS
Get-Service DNS
On any host, read the build with winver and installed updates with Get-HotFix, then match them with the update Microsoft names in its advisory.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- List Windows Server 2025 and Windows 11 systems that run DNS roles or serve DNS.
- Open the Microsoft advisory and note the fixed update for each build.
- Patch domain controllers and DNS servers first, since they face the most network traffic.
- Restrict who can send DNS queries to internal servers to trusted networks.
- Confirm patch status after reboot with
Get-HotFix.
Why it matters
A use after free (CWE-416) is a memory safety bug in which code keeps using memory after it was freed. In a service that parses network input, it can corrupt state in ways an attacker may shape.
High complexity means conditions beyond the attacker's control are needed. The record does not report exploitation and the CVE is not in the CISA KEV catalog. DNS servers are central to a network, so patch them on a priority schedule.
Quick check
Does this affect only servers?
The record lists both Windows 11 and Server 2025 builds. Read Microsoft's advisory for the exact role involved.
Is there a workaround?
The record names none. Apply the update and limit who can reach DNS services.
Sources
Last reviewed: 19 October 2026.
