Windows DNS CVE-2026-65789

The Windows DNS service must be reachable by the attacker over the network on UDP/TCP port 53 - this is satisfied by default for any internet-facing or network-accessible DNS server. No authentication or prior privileges are required (PR:N, UI:N from CVSS vector). The critical limiting factor is AC:H: exploitation requires achieving a precise heap memory state, likely through a race condition or multi-packet grooming sequence, which makes reliable exploitation technically demanding and not readily automatable at scale. The scope is unchanged (S:U), so the impact is bounded to the DNS server process - lateral movement or pivot to other systems is not inherent to the vulnerability itself. No additional non-default configuration prerequisites are described in the available data beyond the DNS role being active and network-accessible.

The CVSS base score of 8.1 reflects a critical theoretical impact (C:H/I:H/A:H) tempered by high attack complexity (AC:H), which meaningfully constrains opportunistic mass exploitation. AC:H in the context of a use-after-free typically indicates a race condition, specific heap layout requirement, or multi-step memory grooming sequence - making reliable remote exploitation considerably harder than an injection or command-injection class vulnerability. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV, and no public proof-of-concept has been identified at time of analysis, suggesting this has not yet been weaponized at scale. The tags include 'Denial of Service' alongside code execution, indicating that even if a reliable RCE primitive proves difficult, crashing the DNS service is a lower-bar, operationally significant impact for any organization relying on Windows DNS for internal name resolution. Real-world priority should be elevated for internet-facing Windows DNS servers and reduced (but not dismissed) for internally segmented deployments.

A remote, unauthenticated attacker sends a crafted sequence of DNS query packets to a Windows DNS server to manipulate heap allocator state, freeing a targeted object while a concurrent processing path retains a dangling pointer to it. The attacker then triggers the dangling reference through a follow-up request, redirecting execution to attacker-controlled data placed in the reclaimed memory region. No public proof-of-concept exists at time of analysis, and the high complexity requirement means exploitation is more likely attempted by sophisticated actors than opportunistic automated scanners.