Windows DNS CVE-2026-49175

Exploitation requires local access to an affected Windows system and a valid low-privileged account or existing code execution on the host (CVSS PR:L, AV:L) - it cannot be triggered remotely or by an unauthenticated actor from the network. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker has any authenticated foothold the barrier is minimal. Exposure is greatest on systems running the Windows DNS Server role and on shared/multi-user hosts (RDP, session hosts, jump boxes) where obtaining a low-privileged local session is realistic; single-user, well-isolated workstations with no untrusted local accounts face materially lower practical risk. The affected versions are limited to the enumerated Windows 10/11 and Server 2022/2025 builds.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity attack requiring low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact on the host - a classic local privilege escalation profile. No EPSS score, SSVC decision data, or KEV listing was provided, and no POC is referenced, so exploitation probability signals are absent rather than low; this should be read as 'unknown likelihood,' not 'safe.' The local attack vector and PR:L requirement meaningfully limit exposure: an attacker must already have a foothold (a valid low-privilege account or code execution) on the system. This is a genuine priority for multi-user, RDP/session-host, and server environments where local footholds are common, but it is not a remotely-wormable network flaw. No signals conflict; the main gap is the absence of exploitation-likelihood telemetry (EPSS/KEV/POC).

An attacker who has already obtained a low-privileged foothold on a Windows host or DNS server - for example a standard domain user account on an RDP session host, or code execution from a separate low-severity bug - triggers the heap-based buffer overflow in the Windows DNS component to corrupt heap memory and elevate to SYSTEM. With SYSTEM privileges the attacker can install tooling, harvest credentials, and pivot across the domain. No public exploit is identified at time of analysis, but the low attack complexity makes reliable exploitation plausible once the vulnerable code path is understood.