Windows DNS Server CVE-2026-83635

Exploitation requires network reachability to the Windows DNS Server service (the DNS Server role must be installed and running, as on Active Directory domain controllers or standalone DNS servers), which is its default operating mode. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no special configuration are needed - an attacker who can send DNS traffic to the listener can trigger the out-of-bounds read. Limiting factors: the target host must actually run the DNS Server role and be network-reachable from the attacker (internet-exposed DNS resolvers/servers are most at risk; internal-only DNS reduces exposure), and the host must be unpatched below the fixed builds (e.g., Server 2025 <10.0.26100.33650, Server 2022 <10.0.20348.5761, Server 2019 <10.0.17763.9376). Impact is confined to service disruption; no code execution, data read, or integrity loss results.

This is a network-reachable, unauthenticated denial-of-service vulnerability in Windows DNS Server, consistent across signals as a moderate-severity availability issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) indicates an attacker can reach the service over the network with no authentication, no user interaction, and low complexity, but impact is limited strictly to availability (C:N/I:N) - an out-of-bounds read (CWE-125) crashing or hanging the DNS service. CISA's SSVC framework reinforces a measured priority: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'yes' (the attack can be scripted and sprayed), and Technical Impact is 'partial' - together suggesting a DoS that could be launched at scale but does not grant code execution or data access. There is no KEV listing and no POC reported, and no EPSS score was supplied, so exploitation likelihood cannot be quantified from the input. Note a tag conflict: the input tags 'Information Disclosure,' yet the CVSS vector sets C:N - an out-of-bounds READ often leaks memory, but the authoritative vector and description both scope impact to denial of service only, so treat 'information disclosure' as unsupported by the official data. Net: a real but routine patch-cycle priority for DNS-serving Windows environments, elevated by its network/unauthenticated reach and automatability, tempered by availability-only impact and no evidence of exploitation.

A remote, unauthenticated attacker sends a specially crafted DNS query or response to a vulnerable Windows DNS Server, triggering an out-of-bounds read that crashes or destabilizes the service and disrupts name resolution for dependent clients. Because the flaw is low-complexity and marked automatable by SSVC, an attacker could script repeated requests to keep the service down. No public exploit code or active exploitation has been identified at time of analysis.