Windows DNS Server EUVD-2026-100443

Exploitation targets the Windows DNS Server role and requires the attacker to already hold low-privilege authorized access (CVSS PR:L) with network reachability to the DNS service; it does not require user interaction (UI:N). The limiting factors are the authentication/authorization requirement - this is not anonymously exploitable - and the impact being confined to information disclosure (C:H, I:N, A:N), meaning a successful attack leaks memory contents but does not alter data or crash the service. The server must be running an affected, unpatched build (e.g. Windows Server 2012 through 2025 and Windows 10/11 DNS components below the fixed versions listed in EUVD-2026-100443).

This is a moderate-priority information-disclosure vulnerability rather than a critical emergency. The CVSS 3.1 base score of 6.5 (Medium) is driven by AV:N (network reachable) and AC:L (low complexity), but is held down by PR:L - exploitation requires the attacker to already hold some level of authorized/low-privilege access, and by the impact profile of C:H/I:N/A:N (confidentiality-only; no integrity or availability loss). No EPSS score, KEV listing, or public POC is present in the provided data, so there is no signal of active or imminent widespread exploitation. The SSVC-style read is: exploitation = none observed, automatable = likely no (requires authenticated access and the out-of-bounds read discloses memory opportunistically), technical impact = partial (information disclosure only). The signals are internally consistent - there is no conflict between the network vector and the description, which both describe a remote but authorized attacker. The main caveat is that 'authorized attacker' in the description aligns with PR:L in the vector, so this is NOT an unauthenticated flaw; treat it as a post-authentication memory-disclosure risk on DNS infrastructure, valuable for leaking adjacent memory (potentially credentials, keys, or ASLR data) but not for direct code execution or denial of service on its own.

An attacker with low-level authorized access to a Windows DNS Server sends specially crafted DNS queries or requests that trigger an out-of-bounds read in the server's parsing logic, causing it to return fragments of adjacent process memory. The leaked memory could contain sensitive data such as credentials, keys, or internal addresses useful for chaining further attacks. No public exploit code is identified at the time of analysis, and exploitation requires existing low-privilege access rather than fully anonymous reach.