Windows DNS CVE-2026-50487

The attacker needs network reachability to a system running the affected Windows DNS component (Windows 11 24H2/25H2/26H1 or Windows Server 2025, including Server Core) at a pre-fix build; the CVSS vector (AV:N/PR:N/UI:N) indicates no authentication and no user interaction against affected configurations. The limiting factors are that the target must be running an unpatched build and be network-reachable on the DNS service, and - despite the published AC:L - successful exploitation of a CWE-416 use-after-free generally requires heap-state control or race-condition timing, which raises practical difficulty; SSVC further notes exploitation is not automatable, so opportunistic mass exploitation is less likely than targeted attempts.

The raw CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) frames this as a trivially exploitable, unauthenticated, network-reachable critical bug with total impact, and SSVC agrees the technical impact is total. However, the signals conflict on real-world urgency: SSVC records Exploitation:none and Automatable:no, EPSS is a modest 0.67% (48th percentile), and there is no KEV listing or public POC - all of which argue against imminent mass exploitation. There is also a semantic tension worth flagging: the description characterizes the outcome as 'elevate privileges over a network,' which is an unusual pairing for an AC:L/PR:N network vector; in practice, reliable exploitation of a use-after-free typically requires heap grooming or winning a race, so the effective attack complexity is likely higher than the AC:L in the published vector suggests - verify exploitability expectations against Microsoft's guidance. Net: treat as a high-priority patch on internet- or network-exposed Windows DNS servers, but current evidence points to it being a serious-but-not-yet-actively-exploited issue rather than a weaponized threat.

An attacker with network reachability to a vulnerable Windows DNS service sends specially crafted DNS traffic that triggers the use-after-free, reclaiming the freed object with attacker-influenced heap data to corrupt memory and pursue privilege elevation. No authentication or user interaction is required per the CVSS vector, though reliable exploitation of a use-after-free realistically requires memory grooming or race timing. No public exploit code has been identified at time of analysis.