CVE-2026-65799 is a medium severity (CVSS 6.7) integer overflow in Windows DNS. Microsoft says an authorized local attacker could gain SYSTEM privileges. The fix shipped in the August 2026 security updates. Install the monthly update that matches your Windows version, with priority on DNS servers.
What's affected
The record describes integer overflow or wraparound in Windows DNS that lets an authorized attacker elevate privileges locally. It maps to CWE-190 and CWE-122, a heap based buffer overflow. The record lists Windows 10 versions 1607, 1809, 21H2 and 22H2, and Windows 11 versions 23H2, 24H2, 25H2 and 26H1. Microsoft's update guide also lists Windows Server editions.
Microsoft scores it 6.7 with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, so the attacker needs local access and high privileges. That matches the record. Microsoft's guide rates exploitation as "Exploitation Unlikely".
Some of the fixed builds Microsoft lists:
- Windows 10 1809 and Windows Server 2019: KB5120238, build 10.0.17763.9121
- Windows 10 21H2 and 22H2: KB5120249, builds 10.0.19044.7663 and 10.0.19045.7663
- Windows Server 2022: KB5120242, build 10.0.20348.5499
- Windows Server 2025: KB5120233, build 10.0.26100.33296
- Windows 11 24H2 and 25H2: KB5121003, builds 10.0.26100.9168 and 10.0.26200.9168
- Windows 11 23H2: KB5120240, build 10.0.22631.7517
- Windows Server 2016 and Windows 10 1607: KB5120418, build 10.0.14393.9418
Microsoft lists more than one KB for some products and also covers Windows 11 26H1, Server 2012 and Server 2012 R2. Use the update guide to choose the right one for your servicing path.
How to check if you're exposed
Check whether the relevant KB is installed. On one machine, run this in PowerShell, with your KB number:
Get-HotFix -Id KB5120238
Also compare the OS build number from winver with the fixed builds above. For fleets, use your patch management tool's compliance report for the August 2026 cumulative update.
Prioritise machines that run the DNS Server role, since the component is Windows DNS, and any host where several people hold local administrator rights.
What to do now
- Identify Windows DNS servers and domain controllers that host DNS.
- Install the August 2026 cumulative update for your version, or a later one.
- Confirm the build number after the restart.
- Reduce the number of accounts with high local privileges.
- Document exceptions where a server cannot be patched yet.
Why it matters
An integer overflow happens when a calculation produces a number too large for its storage, so it wraps around to a small value. If that value is then used to size a memory buffer, the code can write past the end of it. That is the link between CWE-190 and the heap overflow class the record also lists.
Because the attacker already needs high privileges and local access, this is mostly a way to go from a strong account to the highest one. That still matters on shared servers and in incident response, where limiting a compromised admin account is the goal.
Microsoft marks it as not publicly disclosed and not exploited at release, and the record's KEV flag is false.
Quick check
Is this remotely exploitable?
No. The vector is local with high privileges required. The danger is privilege escalation from an existing strong account.
Which KB do I need?
It depends on your Windows version. The update guide lists KBs by product, and the list above shows several of them.
Sources
- Microsoft Security Response Center update guide entry for CVE-2026-65799
- NVD record for CVE-2026-65799
Last reviewed: 18 October 2026.
