Windows DNS CVE-2026-62883

Exploitation requires a local attacker who holds a high-privilege account (PR:H per CVSS vector) - specifically an authorized user with administrative, DNS service management, or equivalent elevated rights on the target Windows system. The Windows DNS component must be installed and operational on the host; this is standard on Windows Server deployments configured as DNS servers but may not be active on all Windows 10/11 client builds. No user interaction is required (UI:N), and attack complexity is Low (AC:L), meaning no race condition or special timing is needed once the privilege threshold is met. Exploitation is strictly limited by the requirement for prior local high-privilege access - remote unauthenticated attackers cannot directly exploit this vulnerability. Scope is unchanged (S:U), confirming the overflow does not inherently pivot to other systems or components. SSVC confirms non-automatable exploitation, consistent with the local credentialed access barrier.

The CVSS 3.1 score of 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately reflects the real-world risk profile: local attack vector and a high privilege prerequisite (PR:H) substantially constrain exploitability. An attacker must already hold administrative or DNS-service-level access on the target host before triggering the overflow. Attack complexity is Low (AC:L), meaning no timing dependency or environmental precondition is required beyond the privilege threshold. Impact metrics are all High, consistent with a heap overflow capable of arbitrary code execution at system level. SSVC analysis corroborates this: Exploitation status is none (no observed exploitation), Automatable is no (cannot be scripted at scale due to local privilege barrier), and Technical Impact is total. No EPSS score was provided; exploitation probability is inferred as low-to-moderate given the absence of public exploit code and the local high-privilege prerequisite. There is no conflict between the CVSS vector and the description - both are consistent in indicating a local, credentialed attack path. This vulnerability is best characterized as a privilege chaining risk: meaningful only after an attacker has already established a high-privilege foothold, at which point it can enable full SYSTEM-level control.

An attacker who has already compromised a high-privilege local account - such as a DNS administrator or server operator - on a Windows Server host crafts a specially formed input to the Windows DNS component that triggers the numeric truncation, producing an undersized heap allocation. The attacker then writes beyond the buffer boundary to overwrite adjacent heap metadata or function pointers, redirecting execution to attacker-controlled code and achieving SYSTEM-level code execution. No public exploit code has been identified at time of analysis, making this scenario currently theoretical but credible given the heap overflow primitive and Low attack complexity rating.