Windows DNS CVE-2026-69369

Exploitation requires an authenticated local session on the affected Windows system with at least low-level privileges (PR:L per CVSS), consistent with any standard user or service account. The attack vector is strictly local (AV:L) - remote unauthenticated exploitation is not possible. The target must be running an affected, unpatched version of Windows DNS (server or client component) within the specified build ranges. No special DNS configuration or non-default settings are described as prerequisites beyond having the DNS component active. The primary limiting factor is the requirement for prior local access: an attacker without an existing foothold cannot exploit this directly from the network.

The CVSS base score of 5.5 (Medium) appropriately reflects the constrained attack surface: exploitation is local-only (AV:L), requires low privileges (PR:L), and produces no integrity or availability impact (I:N/A:N). Despite the C:H metric, the practical risk is bounded by the need for an attacker to already have a local foothold on the target system. No public exploit code exists and the vulnerability is not listed in CISA KEV, meaning there is no evidence of active or widespread exploitation. EPSS data is not provided in the input. The primary real-world risk scenario is post-compromise lateral escalation of information - an attacker already on the box using DNS memory disclosure to recover sensitive data (e.g., cached credentials, internal DNS query content) from process memory. This is a meaningful but not critical finding for most organizations; patching within the normal server maintenance cycle is appropriate rather than emergency response. The broad version range (2012 through 2025) does increase aggregate exposure across enterprise environments.

An attacker who has already obtained a low-privileged local session on a Windows DNS server - via phishing, credential theft, or exploitation of a separate vulnerability - invokes a crafted DNS API call or triggers a vulnerable DNS parsing routine to cause an out-of-bounds read. The resulting memory disclosure may reveal adjacent heap contents, potentially including cached DNS query data, internal network topology, or process memory fragments useful for further attack planning. No public proof-of-concept exists at time of analysis, so exploitation in the wild is not confirmed.