CVE-2011-1966: Windows Server 2008 DNS NAPTR query handling allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 2.0 base score of 10.0 with a network, unauthenticated vector and full confidentiality, integrity and availability impact, plus high EPSS, makes this a top-priority fix for any exposed DNS server.

What it is

The DNS server role in Microsoft Windows Server 2008 SP2, R2 and R2 SP1 mishandles NAPTR queries that trigger recursive processing, a failure of input validation (CWE-20). A crafted query can corrupt memory in the DNS service and let a remote, unauthenticated attacker run code in its context. Because the DNS service is exposed by design, this is a serious pre-authentication flaw on any server running the role.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the DNS service, which on a domain controller can mean full control of the host and the domain. A failed attempt can still crash the service and disrupt name resolution.

Attack surface

Reached over the network by sending a crafted NAPTR query to the DNS server; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required. Only hosts with the DNS server role installed are exposed.

Exploitation

Not listed in CISA KEV and no public exploit or exploit-tagged reference is present in the record, but EPSS is high (0.552, ~99th percentile), suggesting meaningful real-world likelihood. The record does not state whether exploitation has been observed.

What to do

• Apply Microsoft security bulletin MS11-058 (the vendor fix for this issue) to all affected Windows Server 2008 SP2, R2 and R2 SP1 systems, prioritizing domain controllers and other DNS servers.
• If patching cannot be done immediately, restrict UDP/TCP port 53 access to trusted resolvers and clients only, and disable recursion where the server does not need it.
• Remove the DNS server role from hosts that do not require it, reducing the exposed attack surface.
• Monitor vendor and US-CERT (TA11-221A) guidance for any updated workarounds or superseding fixes.

Detection

• Alert on DNS service (dns.exe) crashes or unexpected restarts on Windows Server 2008 DNS hosts.
• Log and review NAPTR query traffic, especially unusual or malformed NAPTR records arriving from external or untrusted sources.
• Watch for unexpected child processes or network connections originating from the DNS service process, which would indicate code execution.
• Correlate DNS server event logs and Windows Error Reporting entries for faults tied to query processing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.