Windows DNS CVE-2026-62778

The Windows DNS Server role must be installed and the DNS service must be running and reachable over the network - this is the default and expected state for any system configured as a DNS resolver or authoritative server. No authentication is required (PR:N per CVSS vector). The critical limiting factor is attack complexity (AC:H): successful exploitation requires winning a race condition timing window by sending precisely timed concurrent DNS requests to hit the freed-memory state before the allocator reassigns it. This timing requirement substantially reduces exploitation reliability and automated scalability compared to simpler memory corruption vulnerabilities. A failed race attempt is likely to crash the DNS service rather than achieve privilege escalation, generating a detectable availability impact. The vulnerability applies equally to full GUI installations and Server Core installations, so minimal-footprint deployments are not protected. No non-default configuration of the DNS service is required for the attack surface to be present.

The CVSS 8.1 score reflects high theoretical impact (C:H/I:H/A:H) tempered by high attack complexity (AC:H), the latter directly attributable to the race condition exploitation requirement - an attacker must reliably win a timing window rather than send a single malformed packet. The absence of a CISA KEV listing and no confirmed public exploit code at time of analysis reduces immediate operational urgency compared to simpler, actively-exploited vulnerabilities. However, the network-accessible, unauthenticated attack vector (AV:N/PR:N) means no foothold or credentials are needed, so any system with its DNS service reachable over the network is a direct target. EPSS data was not provided in the source intelligence, limiting probabilistic exploitation scoring. The Tags field includes 'Denial of Service,' suggesting failed race exploitation may crash the DNS service, introducing an availability risk independent of full privilege escalation success. The breadth of affected versions - thirteen distinct product SKUs from Server 2012 through Server 2025 - means even a mid-sized municipal IT team in swidnica running a heterogeneous Windows Server estate should treat this as urgent, given patching complexity across generations. Race-condition-based privilege escalation flaws have historically proven exploitable once adversaries complete sufficient timing analysis, so the EPSS probability may rise as the vulnerability matures in the public domain.

A remote unauthenticated attacker sends specially crafted, precisely timed concurrent DNS queries to a vulnerable Windows DNS server, racing to access freed memory before it is reallocated. Successfully corrupting the freed memory object redirects execution flow and elevates the attacker's privileges on the DNS server, potentially to SYSTEM level. No public exploit code has been identified at time of analysis; failed race attempts are likely to crash the DNS service and manifest as detectable availability incidents.