Windows DNS Server CVE-2026-83889

Exploitation requires the Windows DNS Server role to be installed and running, and the attacker must be an authorized/low-privileged principal able to reach the DNS service over the network (CVSS PR:L), per Microsoft's 'authorized attacker' wording. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the target must actually host the DNS Server role (not a default workstation configuration), and the attacker must first hold at least low-level authentication/privileges rather than being fully anonymous - this narrows exploitation to insiders or attackers who have already gained a foothold or valid low-privilege credentials.

This is a genuine high-priority vulnerability for organizations running the Windows DNS Server role, though not an emergency-grade drop-everything issue at the time of analysis. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity code execution with full confidentiality, integrity, and availability impact, requiring only low-level privileges (PR:L) and no user interaction. CISA's SSVC framework corroborates the severity on impact (Technical Impact: total) but tempers the urgency: Exploitation is rated 'none' (no observed or public exploitation) and Automatable is 'no', indicating it is not currently wormable or mass-exploitable. The CVE is NOT listed in CISA KEV and no public proof-of-concept is indicated in the provided data, so this reflects no public exploit identified at time of analysis. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. The signals are therefore consistent rather than conflicting: high potential impact and network reachability, but no evidence of active or automatable exploitation yet. One data-quality note: the input Tag 'Information Disclosure' conflicts with the description, which states code execution and carries full I:H/A:H impact - this is an RCE-class flaw, not merely information disclosure, so the tag appears mislabeled.

An attacker with low-privilege authenticated access reachable to a Windows DNS Server sends specially crafted DNS protocol traffic that triggers release of an invalid pointer or reference (CWE-763), corrupting memory on the server. By controlling the freed/invalid reference, the attacker achieves arbitrary code execution in the context of the DNS service over the network. No public exploit or proof-of-concept is identified at time of analysis, and no user interaction is required.