Windows DNS CVE-2026-70330

Exploitation requires a local authenticated session with at minimum low-privilege rights on the target Windows system, consistent with CVSS AV:L/PR:L. The attacker must already have obtained local code execution or interactive logon access - remote unauthenticated exploitation is not indicated by the local attack vector. No specific non-default configuration or additional feature enablement is described as a prerequisite beyond the presence of the vulnerable Windows DNS component, which is included in default installations of all affected Windows editions. The SSVC automatable: no rating indicates exploit reliability likely depends on heap layout conditions, limiting reliable mass exploitation. The sole exploitation limit confirmed by available data is the requirement for prior local authenticated access.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a locally exploitable flaw requiring no user interaction and only low-privilege credentials, yielding complete CIA impact on the vulnerable system. EPSS stands at 0.33% (26th percentile), indicating low current exploitation probability relative to the broader CVE corpus - consistent with the SSVC signal of exploitation: none and automatable: no. However, SSVC simultaneously records technical impact as total, acknowledging worst-case post-exploitation outcome. The CISA KEV list does not include this CVE, aligning with the low EPSS and SSVC exploitation=none ratings. The primary risk driver is the extraordinary breadth of affected Windows versions - from Server 2012 through Server 2025 and Windows 10 through 11 - meaning the aggregate attack surface is very large even if per-system exploitation probability is currently low. The SSVC automatable=no finding limits mass exploitation scenarios but does not reduce risk for targeted post-access privilege escalation, where heap overflow primitives are commonly weaponized. The key limiting factor is the prerequisite of prior local authenticated access.

An attacker who has obtained a low-privilege local account - for example through credential theft following a phishing campaign or lateral movement - sends a specially crafted input to the Windows DNS component that triggers the heap-based buffer overflow. By controlling overflow payload content and heap layout, the attacker corrupts heap structures to redirect execution, ultimately achieving code execution at SYSTEM privilege level. No public exploit code has been identified at time of analysis, so this scenario currently requires custom exploit development against the specific target build.