Windows DNS CVE-2026-65797

Exploitation requires the attacker to already hold high local privileges (PR:H per CVSS vector) on the target Windows system - this is explicitly described as an 'authorized attacker' in the CVE description, meaning unauthenticated or low-privilege exploitation is not applicable. The attacker must have local access to the machine (AV:L); remote unauthenticated exploitation is not applicable. The Windows DNS service component must be present and accessible on the affected system; while the DNS client stack is present on all Windows versions, DNS server functionality is most relevant on Windows Server editions configured with the DNS Server role. No user interaction is required once access conditions are met. Exploitation is bounded by: (1) the need for pre-existing high local privileges, (2) local-only attack vector eliminating remote unauthenticated risk, and (3) unchanged scope meaning compromise is contained to the vulnerable system's security context.

The CVSS base score of 6.7 (Medium-High) reflects a meaningful but bounded threat posture. The vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H signals that while the impact is severe (full confidentiality, integrity, and availability compromise), exploitation requires the attacker to already hold high local privileges - this is a privilege escalation primitive, not an initial access vector. Real-world risk is therefore contingent on a preceding compromise or insider threat scenario; the flaw extends an attacker's reach rather than enabling initial footing. No EPSS score was provided in the source data, precluding probabilistic exploitation comparison. KEV status is absent, meaning active exploitation has not been confirmed by CISA at time of analysis. No public proof-of-concept exploit has been identified. Attack complexity is low (AC:L), suggesting that once an attacker meets the privilege precondition, the exploit path is straightforward - this is noteworthy because it increases the value of this vulnerability as a post-exploitation escalation step in an attacker's chain. The very broad affected version range (Server 2012 through Server 2025, multiple Windows 10 and 11 branches) substantially widens the organizational attack surface. Overall: a genuine but secondary-priority patching concern - highest urgency for environments where DNS server roles coexist with partially-trusted admin accounts or remote management surfaces.

An attacker who has already obtained high-privileged local access to a Windows system running the DNS service - for example, a domain administrator or a threat actor who has laterally moved and escalated to an admin account - crafts an interaction with the DNS service that triggers the numeric truncation error, causing a heap-based buffer overflow. This overflow corrupts heap metadata or adjacent memory structures, enabling the attacker to redirect execution flow within the DNS service process and achieve code execution at a higher privilege level (e.g., SYSTEM). No public proof-of-concept exploit code has been identified at time of analysis, but the low attack complexity rating (AC:L) suggests the trigger condition is relatively straightforward once the privilege precondition is met.