Windows DNS Server EUVD-2026-100440

Exploitation requires the Windows DNS Server role to be installed and reachable, plus low-level authentication/privileges (CVSS PR:L) - it is not an unauthenticated internet-wide attack. The out-of-bounds read is triggered by processing a crafted DNS request, with no user interaction needed (UI:N). Limiting factors: the attacker must first obtain valid low-privilege access to query or reach the DNS service, impact is confined to information disclosure (C:H only, no integrity or availability effect), and only the listed pre-patch Windows Server and Windows 10/11 builds running the DNS Server role are affected. Risk concentrates on DNS servers exposed beyond a trusted boundary.

This is a moderate, authenticated information-disclosure flaw rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates network reach with low attack complexity and no user interaction, but it requires privileges (PR:L), so the attacker must already be authenticated to the DNS service or environment. Impact is confidentiality-only and high (C:H), with no integrity or availability effect - consistent with a CWE-125 out-of-bounds read leaking memory contents. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is currently no evidence of active or imminent widespread exploitation. The signals are internally consistent (an authenticated read-only disclosure over the network), with no network-vs-local contradiction. Net assessment: a real but not critical priority - patch during normal Microsoft Patch-Tuesday cycles, prioritizing internet- or forest-exposed DNS servers; the authentication requirement and read-only impact materially lower real-world risk versus an unauthenticated RCE. Absence of EPSS/KEV/POC data is a gap, not confirmation of safety.

An attacker who already holds low-level authenticated access sends a specially crafted DNS query to a vulnerable Windows DNS Server, triggering an out-of-bounds read that returns adjacent process memory in the response. Over repeated requests this could leak sensitive in-memory data (e.g., cached records, pointers, or configuration fragments) that aids further attacks. No public exploit code was identified at the time of analysis, and no user interaction is required.