Windows DNS CVE-2026-70119

Requires network reachability to a Windows DNS service running on affected builds (Windows Server 2022 prior to 10.0.20348.5761, or Windows Server 2025 prior to 10.0.26100.33650, including Server Core), plus low-level authorization (PR:L) - i.e. the attacker must be an already-authenticated/authorized actor rather than fully anonymous, which meaningfully limits the attacker population. No user interaction is required (UI:N) and attack complexity is low (AC:L). Impact is confined to availability (A:H) with no confidentiality or integrity effect per the vendor vector, so realistic risk is disruption of DNS/name resolution rather than data theft. Note the description's 'execute code' claim is not supported by the CVSS impact metrics and should be confirmed with Microsoft.

Signals point to a moderate, non-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable, low-complexity flaw requiring low-level privileges (PR:L) with impact limited exclusively to availability (C:N/I:N) - consistent with CWE-125 out-of-bounds read causing a service crash. CISA's SSVC decision framework reinforces low urgency: Exploitation=none (no observed activity), Automatable=no, and Technical Impact=total. There is no CISA KEV listing and no public exploit identified, and no EPSS score was provided, so no probabilistic exploitation estimate is available. A key CONFLICT must be flagged: the human-readable description states the attacker can 'execute code over a network,' but the vendor CVSS vector assigns ZERO confidentiality and integrity impact and only availability impact (A:H) - which is characteristic of a denial-of-service/crash, NOT remote code execution. This discrepancy should be verified with Microsoft; treat the practical impact as a DoS of the DNS service unless the vendor confirms true code execution. Overall this is a genuine-but-moderate issue: patch in normal cycle, prioritizing internet-exposed or multi-tenant DNS servers.

An attacker who already holds low-level authenticated access to the network sends a specially crafted request to a vulnerable Windows DNS service, triggering an out-of-bounds read in the DNS parsing code. The malformed data causes the DNS service to read beyond allocated bounds and crash, disrupting name resolution for dependent systems. No public exploit code has been identified at the time of analysis, and CISA SSVC rates the flaw as not automatable.