Windows DNS Server EUVD-2026-100039

The vulnerable Windows DNS Server role must be installed and running and reachable by the attacker over the network; exploitation requires driving that server into processing attacker-controlled DNS data (UI:R), such as resolving an attacker-owned domain, rather than passive exposure alone. Limiting factors: hosts without the DNS Server role are not affected; the UI:R requirement means the server must be induced to handle the malicious input, so purely idle servers that never resolve attacker-influenced records are at reduced risk; and patched builds (per the EUVD fixed-version thresholds, e.g. Windows Server 2025 >=10.0.26100.33650) are not exploitable. No authentication is required (PR:N). The description does not specify the exact DNS record type or parsing path, so the precise trigger beyond 'untrusted pointer dereference in DNS Server' is not confirmed from available data.

This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated remote code execution in the Windows DNS Server with full confidentiality, integrity, and availability impact - a very dangerous profile for an infrastructure service that typically runs on domain controllers. The one meaningful brake is UI:R (user interaction required), which lowers this from a wormable, fully-automatable threat to one that needs the DNS Server to be induced into processing attacker-controlled data (e.g., resolving a malicious record), so it is not a self-propagating network worm. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation probability signals are absent - this means there is no confirmed active exploitation and no evidence of mass scanning at analysis time, but absence of these feeds is not evidence of safety. Note a data conflict: the single input Tag is 'Authentication Bypass,' which contradicts the description (an untrusted pointer dereference leading to RCE, CWE-822) and the vector - treat the tag as mislabeled, not as a second vulnerability class. Overall this warrants prompt patching of the Windows DNS Server role due to severity and vendor-confirmed patch availability, tempered by the UI:R prerequisite and the lack of any confirmed in-the-wild exploitation.

An attacker hosts a malicious DNS response and induces a vulnerable Windows DNS Server to process it (e.g., by triggering recursive resolution of an attacker-controlled domain), causing an untrusted pointer dereference that corrupts memory and leads to code execution in the DNS service context. Because the DNS Server role commonly runs on domain controllers, successful exploitation can yield a foothold on high-value infrastructure. No public exploit identified at time of analysis; the UI:R metric indicates the attack requires the server to be driven into handling the crafted data rather than purely passive exposure.