EUVD-2026-73662
GHSA-g4f6-9fhf-mqp5
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible DNS service with UAF requiring heap grooming (AC:H); authorized attacker (PR:L); full system compromise but no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows DNS allows an authorized attacker to execute code over a network.
AnalysisAI
Use-after-free in the Windows DNS Server component on Windows Server 2025 enables an authorized network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 7.5 rating with high attack complexity (AC:H) and low privilege requirements (PR:L), matching Microsoft's framing of an 'authorized attacker,' which constrains opportunistic exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold authenticated network access to the target - meaning an account with at least low-level privileges (confirmed by PR:L in the CVSS vector) - and to successfully manipulate heap state, which is the basis for the high complexity rating (AC:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 with AV:N/AC:H/PR:L reflects a meaningful reduction in practical exploitability compared to simpler unauthenticated remote bugs: the attacker must hold at least low-level authenticated access and overcome high complexity, which typically involves heap-grooming or timing-sensitive race conditions characteristic of UAF class vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released cumulative update that brings Windows Server 2025 to build 10.0.26100.33438 or later, available through Windows Update, WSUS, or the Microsoft Update Catalog as directed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72928. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Windows Server 2025 DNS servers, verify current build versions, and prepare to test vendor patch 10.0.26100.33438 in staging environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today