Rapid7’s 2026 Global Cybersecurity Summit is now available on-demand.Watch sessions.
Rapid7

module

Microsoft Windows DNSAPI.dll LLMNR Buffer Underrun DoS

Disclosed
Apr 12, 2011

Description

This module exploits a buffer underrun vulnerability in Microsoft's DNSAPI.dll
as distributed with Windows Vista and later without KB2509553. By sending a
specially crafted LLMNR query, containing a leading '.' character, an attacker
can trigger stack exhaustion or potentially cause stack memory corruption.

Although this vulnerability may lead to code execution, it has not been proven
to be possible at the time of this writing.

NOTE: In some circumstances, a '.' may be found before the top of the stack is
reached. In these cases, this module may not be able to cause a crash.
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.