Windows DNS Server EUVD-2026-100423

Exploitation requires the DNS Server role to be installed and running on an affected Windows build, plus the authorization level implied by PR:L - the attacker must be an authorized actor able to submit queries or data the vulnerable parser processes, not an anonymous Internet client. Impact is limited to disclosure of server memory (C:H) with no integrity or availability effect, so it cannot be used directly for code execution or service disruption. The PR:L authorization requirement and the information-only impact are the primary limiting factors; no user interaction is required (UI:N), and all listed Windows 10/11 and Windows Server builds below the patched versions are vulnerable.

This is a moderate-severity information disclosure flaw (CVSS 6.5) in Microsoft Windows DNS Server. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring some level of authorization (PR:L), with high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N) - consistent with an out-of-bounds read (CWE-125) that leaks memory contents. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The PR:L requirement meaningfully lowers real-world urgency compared to an unauthenticated RCE: an attacker must already hold some authorized access to the DNS service, and the impact is limited to information disclosure rather than code execution or denial of service. Net assessment: this is a genuine patch-worthy issue given the ubiquity of Windows DNS Server in enterprise environments, but it is not an emergency - it ranks below unauthenticated or wormable Windows vulnerabilities. Note the 'Buffer Overflow' input tag is imprecise: the CWE-125 out-of-bounds READ is a buffer over-read (disclosure), not a classic overflow write, which aligns with the I:N/A:N impact profile.

An attacker with authorized network access to a Windows DNS Server sends a specially crafted DNS query or record that triggers an out-of-bounds read in the server's parsing logic. The server returns or processes adjacent memory contents, disclosing potentially sensitive information such as memory fragments or configuration data. No public exploit code is identified in the provided data, and the low attack complexity suggests reliable triggering once the required authorization is obtained.