Windows DNS CVE-2026-70304

Exploitation requires a locally authenticated session with at minimum low-level user privileges, as confirmed by the CVSS PR:L metric. The AV:L vector confirms that this vulnerability is not remotely exploitable over the network - the attacker must have a local interactive session, console access, or Remote Desktop Protocol access with valid credentials. No user interaction from a higher-privileged user is required (UI:N). No special non-default DNS configuration is described in available data as a prerequisite; the flaw appears to reside in standard DNS component functionality present in default Windows installations. Key limiting factors include: requirement for a prior local session, non-automatable exploitation per SSVC (ruling out worm or mass exploitation), no scope change beyond the compromised host (S:U), and the absence of any public exploit code at time of analysis.

The CVSS 7.8 High score is well-supported by the AV:L/AC:L/PR:L/UI:N vector, indicating that once local access is achieved, exploitation is mechanically straightforward with no user interaction or elevated starting privileges required. SSVC rates the technical impact as total, confirming complete system compromise on successful exploitation. Counterbalancing this severity, SSVC records current exploitation as none and the attack as non-automatable, and the EPSS score of 0.33% (26th percentile) reflects below-average near-term exploitation probability based on current threat intelligence - suggesting no active threat actor has yet weaponized this flaw at scale. The non-automatable SSVC rating is significant: it rules out worm-style or mass automated exploitation, requiring instead an attacker who already holds a local session. Despite the absence of active exploitation, the sheer breadth of affected platforms - spanning a decade of Windows releases across client and server editions - means that even a mid-sized municipal IT team in koszalin should treat this as an urgent patching priority, given that SSVC's total technical impact rating leaves no margin for delay if an attacker does obtain local access. No conflicting signals are present between CVSS, EPSS, and SSVC data.

An attacker holding a low-privileged domain or local user account on a Windows system - such as a compromised service account, a rogue insider, or an attacker who has completed an initial access phase via phishing - executes a crafted operation that triggers the heap-based buffer overflow in the Windows DNS component, corrupting adjacent heap memory to redirect execution flow and escalate to SYSTEM privileges. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) implies that a functional exploit could be developed from analysis of the vendor patch diff.