Windows DNS Server CVE-2026-72987

The Windows DNS Server service must be running and reachable over UDP or TCP port 53 from the attacker. No authentication is required (PR:N). Attack complexity is high (AC:H), meaning the attacker must engineer specific heap state - likely through a sequence of DNS requests - to reliably exploit the race or timing window inherent in the UAF condition; casual or automated scanning is unlikely to succeed without a purpose-built exploit. There are no additional non-default configuration requirements documented. Exploitation is limited to Windows Server systems with the DNS Server role installed; Windows client OS builds appear in the affected list (Windows 10 1607/1809) only if the optional DNS Server feature is enabled, which is non-default on workstations.

The CVSS 8.1 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H correctly reflects both the severity of full compromise and the non-trivial exploitation path. AC:H is the single significant mitigating factor: a UAF in a DNS parser typically requires precise heap state to convert a crash into reliable code execution, raising the bar for commodity exploitation. No CISA KEV listing and no public POC are confirmed, which aligns with the high-complexity barrier. However, Windows DNS Server is the backbone of virtually every enterprise Active Directory deployment, and state-sponsored or well-resourced threat actors have historically targeted DNS services; the absence of a POC today does not imply long-term safety. The 'Denial Of Service' tag in the input metadata understates the true impact - the Microsoft description and the C:H/I:H/A:H vector both indicate full RCE, not merely availability impact. EPSS data is not provided; given AC:H and no KEV, real-world exploitation probability is currently assessed as low-to-moderate but may escalate once a patch is reversed.

An attacker on the network - with no credentials - sends a sequence of crafted DNS queries to a Windows DNS Server designed to manipulate the heap layout and trigger a use-after-free condition in the DNS request processing path. Once the freed memory region is reclaimed under attacker-controlled content, the dangling pointer dereference redirects execution to attacker-supplied shellcode, yielding SYSTEM-level code execution on the DNS server. No public POC exists at time of analysis, but the attack is theoretically achievable by a skilled adversary through heap-spray or race-condition techniques well-documented in the UAF exploitation literature.