Windows DNS Server EUVD-2026-100439

Exploitation requires the attacker to already hold low-privilege authorized access to the target Windows DNS Server (PR:L) and network reachability to the DNS service, after which a crafted DNS request triggers the out-of-bounds read to leak server process memory. LIMITING FACTORS: the mandatory pre-existing authorization materially narrows the attacker population versus an unauthenticated flaw; impact is confined to information disclosure (C:H, I:N, A:N) with no code execution or service disruption; and only systems running the Windows DNS Server role within the listed unpatched build ranges are affected. No user interaction is required (UI:N) and attack complexity is low (AC:L). The specific DNS record or query feature that triggers the condition is not disclosed in the vendor advisory.

This is a moderate-priority information-disclosure flaw, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack that requires an already-authorized (low-privilege) attacker and yields high confidentiality impact with no integrity or availability effect - consistent with the CWE-125 out-of-bounds read and the description's 'authorized attacker' language, so the signals are internally coherent. However, several real-world risk signals are MISSING from the input: no EPSS exploitation-probability score is provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced (exploitation status: no public exploit identified at time of analysis). The sole reference is the Microsoft MSRC advisory and the reporter is Microsoft itself (secure@microsoft.com), with no third-party corroboration of active exploitation. The PR:L requirement meaningfully constrains the attacker population - an adversary must already hold some authorized access/credentials to the DNS service - which lowers real-world risk relative to an unauthenticated (PR:N) flaw. Net assessment: a genuine but memory-disclosure-only issue warranting routine prioritized patching across the large Windows DNS Server fleet, rather than drop-everything emergency response, absent any EPSS/KEV/POC evidence of exploitation.

An attacker holding low-privilege authorized access to a Windows DNS Server sends a specially crafted DNS request that triggers an out-of-bounds read, causing the service to return adjacent process memory in its response. Because the CVSS vector is AV:N/AC:L/PR:L, this can be performed over the network with low complexity but requires existing authorization and no user interaction. No public exploit code is identified in the provided data, so exploitation is currently theoretical.