Windows DNS CVE-2026-62769

The CVSS vector (AV:L/PR:H) explicitly requires local system access with high-privilege credentials. The CVE description's use of 'authorized attacker' confirms that the threat actor must possess a legitimate but high-privilege account on the target host - specifically, accounts such as members of the DnsAdmins group, local Administrators, or equivalent roles capable of interacting with the Windows DNS service at an elevated level. The attack cannot be performed remotely over the network; physical or authenticated remote-session local access to the DNS-hosting system is required. No special non-default configuration of the DNS service itself is stated as a prerequisite - any system running Windows DNS with a high-privilege local session in scope is potentially vulnerable. What concretely limits exploitation is the conjunction of: (1) local or remote-desktop session access to the target host, and (2) possession of a high-privilege account on that host. These two barriers together make opportunistic or automated mass exploitation infeasible, as confirmed by SSVC's automatable: no classification.

The CVSS 3.1 score of 6.7 (Medium-High) is shaped primarily by the local attack vector (AV:L) and high-privilege prerequisite (PR:H), both of which substantially constrain real-world exploitability relative to the total technical impact (C:H/I:H/A:H). SSVC independently confirms exploitation status as none and automatable as no - consistent with the local, credentialed access barrier preventing automated or mass remote exploitation. Despite these constraints, SSVC rates technical impact as total, confirming that a successful exploit yields complete system compromise within the vulnerable component's privilege context. No EPSS probability score was provided in the input data; however, the SSVC exploitation-none classification is the authoritative signal available and aligns with the high-privilege local access barrier. This vulnerability is best characterized as a post-compromise escalation risk or an insider-threat scenario rather than a primary initial-access vector. The broad affected version footprint - from Windows Server 2012 through 2025 and Windows 10/11 - increases aggregate exposure across enterprise environments, but the PR:H requirement means only accounts already holding DNS operator or local administrator privileges on the target host are viable threat actors. No conflict exists between CVSS vector and the description; both consistently indicate local, high-privilege exploitation. This is a real but targeted priority, not a mass-exploitation emergency.

An attacker who has already obtained a high-privilege local account - such as a compromised DnsAdmins group member or local administrator on a Windows DNS Server host - submits a crafted DNS request or invokes a DNS service API with a malformed length field that triggers the numeric truncation in the heap allocation routine. The resulting undersized heap buffer is overflowed with attacker-controlled data, corrupting adjacent heap structures, and the attacker leverages this corruption to overwrite a control structure or function pointer and redirect execution to attacker-controlled code running as SYSTEM. No public exploit code has been identified at time of analysis, but the heap overflow primitive with total C/I/A impact represents a well-understood exploitation class that capable threat actors could develop into a reliable exploit.