Windows DNS Server CVE-2026-88112

The Windows DNS Server role must be installed, enabled, and network-reachable on an affected, unpatched build (per the EUVD version ranges across Windows 10/11 and Server 2012 R2 through 2025). Exploitation is unauthenticated (PR:N) over the network (AV:N) with low complexity (AC:L), but the CVSS vector specifies UI:R - user or operator interaction is required, meaning the server must be induced to process the attacker's crafted DNS data (e.g., via a resolution/query path) rather than the attacker driving the entire exploit passively. This UI:R requirement is the primary limiting factor reducing realistic risk below a fully wormable remote exploit; hosts not running the DNS Server role are not affected.

This is a genuine high-priority vulnerability. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity, and availability impact - code execution on a Windows DNS Server. CWE-822 (untrusted pointer dereference) is consistent with memory-corruption leading to RCE. The single mitigating signal in the CVSS is UI:R (user/operator interaction required), which prevents fully automated drive-by exploitation and typically means a victim must process attacker-supplied DNS data. No EPSS score, CISA KEV listing, or POC indicator was provided in the input, so exploitation likelihood cannot be quantified; there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a data conflict: the input Tag 'Authentication Bypass' does not match the described untrusted-pointer-dereference RCE and appears mislabeled - do not treat this as an auth-bypass issue. Because a vendor patch is already available and DNS is a core infrastructure role, this should be patched on an expedited schedule despite the absence of in-the-wild exploitation signals.

A remote, unauthenticated attacker crafts malicious DNS data that, when processed by the target's Windows DNS Server, dereferences an attacker-influenced untrusted pointer and corrupts memory to achieve code execution. Because the CVSS vector specifies UI:R, the attack realistically depends on a victim or server operation triggering the processing of the crafted response (e.g., a DNS query/resolution path) rather than a purely passive server exploit. No public exploit code was identified in the provided data.