Windows DNS Server EUVD-2026-100447

Exploitation requires the target to be running the Windows DNS Server role (not enabled by default on client Windows, but standard on domain controllers and DNS infrastructure servers) and reachable over the network. Per CVSS PR:L, the attacker must already hold some level of authorization/privilege - the description's phrase 'authorized attacker' confirms this is not an unauthenticated flaw, though the exact required privilege (any authenticated principal vs. a DNS/administrative role) is not specified and should be verified against the MSRC advisory. No user interaction is required (UI:N). Limiting factors: the need for prior authorization, the read-only nature (confidentiality-only impact, no integrity/availability effect), and SSVC Automatable=no indicating it does not lend itself to reliable large-scale automated exploitation. Affected builds are enumerated in the EUVD data; patched builds are available for each (e.g., Windows Server 2025 fixed in 10.0.26100.33650, Server 2022 in 10.0.20348.5761).

This is a moderate-priority information-disclosure issue, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable out-of-bounds read requiring low privileges, with high confidentiality impact but no integrity or availability impact. CISA's SSVC framework agrees on limited urgency: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably mass-scripted), and Technical Impact=partial. No CISA KEV listing and no public exploit were provided, so the signals are internally consistent - a genuine but contained read-only disclosure flaw rather than a wormable or high-automation threat. Note a mild tension worth verifying: CVSS marks PR:L (some authentication/privilege required) while the one-line description only says 'authorized attacker,' giving no detail on what level of authorization (e.g., any authenticated user vs. a privileged DNS operator) is actually needed - this materially affects real-world reachability and should be confirmed against the Microsoft advisory. No EPSS score was supplied, so statistical exploitation probability cannot be weighed here.

An attacker with low-level authorized access sends a crafted DNS query or request to a Windows DNS Server, triggering an out-of-bounds read that returns adjacent process memory in the response. The leaked memory could expose sensitive internal data such as configuration fragments, cached records, or memory that aids further attacks. No public proof-of-concept was identified, and the CVSS low attack complexity (AC:L) means exploitation is technically straightforward once the required privilege level is held.