Windows DNS Server EUVD-2026-100432

Exploitation requires network reachability to the Windows DNS Server role plus some level of valid privilege (CVSS PR:L), so this is an authenticated flaw - not anonymous internet-wide exploitation. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The impact is limited strictly to information disclosure (C:H, I:N, A:N): a successful attack leaks server memory contents but does not modify data or disrupt the service. Limiting factors for defenders: the PR:L requirement means an attacker must already possess some access to the DNS service, the affected builds are specific (see enumerated version ranges below the vendor-fixed thresholds), and only hosts running the DNS Server role are exposed. The description does not name a specific non-default feature, so default DNS Server deployments within the affected build ranges should be considered vulnerable until patched.

This is a genuine but moderate-priority issue rather than an emergency. The CVSS 6.5 (MEDIUM) vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates network-reachable, low-complexity exploitation with no user interaction, but it requires privileges (PR:L) and yields only confidentiality impact (C:H, I:N, A:N) - consistent with an out-of-bounds read (CWE-125) that leaks memory without corrupting data or crashing the service. Key enrichment signals are absent: there is no CISA KEV listing, no EPSS probability supplied, and no public proof-of-concept referenced, so the current threat picture is 'no public exploit identified at time of analysis.' One signal to reconcile explicitly: the input Tags include 'Buffer Overflow,' but the CWE (125) and description describe an out-of-bounds READ (information disclosure), not a memory-corrupting overflow write - the tag overstates the impact class and should not be read as indicating code execution. Because EPSS and POC data were not provided (not zero, simply missing), probability of near-term widespread exploitation cannot be quantified from this data; the authenticated (PR:L) requirement further narrows realistic attackers to those who already hold some foothold or valid access to the DNS service.

An attacker who already holds low-level authenticated access sends a specially crafted DNS query or record to a vulnerable Windows DNS Server over the network, triggering an out-of-bounds read that returns adjacent process memory in the response. The leaked memory could expose sensitive server-side data useful for further attacks. No public proof-of-concept is identified at the time of analysis, and low attack complexity (AC:L) means a working exploit would be reliable once developed.