Windows DNS Server EUVD-2026-100446

Exploitation requires the target host to be running the Windows DNS Server role (a server-side feature, not present on default client installs unless the DNS Server role is enabled) and reachable over the network on its DNS service. The CVSS vector's PR:L confirms the attacker must hold some level of authorization to the service rather than being fully anonymous, which limits exploitation to actors who already have authorized interaction with the DNS server. No user interaction is required (UI:N). Impact is limited to confidentiality (memory disclosure) - there is no integrity or availability impact (I:N/A:N), so this cannot by itself alter DNS records or crash the service. Patched by applying the vendor update to bring builds to or above the fixed versions listed per Windows release (e.g., Windows Server 2025 build 10.0.26100.33650, Windows Server 2022 build 10.0.20348.5761).

This is a genuine but moderate-priority issue, not a top-of-queue emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack but one that requires some level of authorization (PR:L), with high confidentiality impact and no integrity or availability impact - consistent with an out-of-bounds read (CWE-125) that leaks memory contents. All corroborating exploitation signals point low: SSVC from CISA lists Exploitation=none, Automatable=no, and Technical Impact=partial, which aligns with a read-only information-disclosure flaw rather than code execution. There is no CISA KEV listing and no public exploit identified, and no EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are internally consistent (medium CVSS, partial impact, not automatable, no known exploitation), so this reads as a real but non-urgent patch-in-normal-cycle item. One note of caution: the description says 'authorized attacker' while the 'Buffer Overflow' tag suggests memory corruption - but CWE-125 and the C:H/I:N/A:N impact confirm this is a read-only disclosure, not a writable overflow; the tag appears imprecise.

An attacker who already holds low-level authorization to interact with the Windows DNS Server service sends specially crafted DNS queries or requests over the network that trigger an out-of-bounds read in the server's parsing logic. The server returns or processes memory beyond the intended buffer, disclosing adjacent process memory (potentially containing sensitive data) to the attacker. No public proof-of-concept exploit has been identified at the time of analysis.