Windows DNS CVE-2026-69310

The attacker must already have local access to the affected system with at minimum a low-privilege (PR:L) account - the Microsoft description explicitly states 'authorized attacker' performing local privilege escalation. The Windows DNS service (DNS Client and/or DNS Server role) must be running on the target. The high attack complexity (AC:H) requires overcoming exploitation constraints consistent with UAF heap-state manipulation, meaning the attacker cannot simply send a single crafted packet; they must carefully arrange memory layout or time a race condition. No special non-default configuration of the DNS service is indicated as required - any Windows system with DNS active and accessible to a low-privilege local account is within scope. Exploitation is strictly local (AV:L); remote network exploitation without an existing foothold is not indicated.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a locally exploitable privilege escalation with full C/I/A impact potential, but the AC:H metric accurately captures the genuine difficulty of reliable UAF exploitation, which typically requires heap grooming, timing-sensitive race conditions, or both. No EPSS score was provided in the available intelligence, limiting probabilistic exploitation forecasting. No KEV listing and no public exploit code have been identified, placing this in the 'no public exploit identified at time of analysis' category. The breadth of affected versions - spanning Server 2012 R2 through Server 2025 and Windows 10/11 client editions - means the total attack surface is very large across enterprise Windows estates. The AC:H modifier meaningfully reduces exploitation reliability compared to trivial memory corruption bugs; however, the local privilege escalation path from a low-privileged foothold to SYSTEM makes this a high-value target for post-compromise lateral movement, particularly on Windows Server systems where DNS is co-located with domain controller roles.

A threat actor who has already compromised a low-privilege account on a Windows system - via phishing, credential stuffing, or lateral movement - targets the Windows DNS service by triggering a use-after-free condition through a crafted sequence of DNS operations, requiring heap manipulation or race condition exploitation to achieve reliable control. Upon successful memory corruption, the attacker redirects execution into attacker-controlled code within the DNS process context, escalating from the initial low-privilege account to SYSTEM. No public exploit code exists at time of analysis, but this class of UAF attack is well-understood by advanced adversaries conducting post-compromise privilege escalation.