Windows DNS Server EUVD-2026-100448

Exploitation requires the target host to be running the Windows DNS Server role (commonly present on Active Directory domain controllers) and reachable over the network, and the attacker must already hold low-level authorization (PR:L) - it is NOT unauthenticated. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the privilege requirement and the information-disclosure-only outcome (no write/RCE) limit real-world severity. The description provides no further configuration-specific prerequisite beyond the DNS Server role being present and serving requests.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 base score of 6.5 (Medium) is driven by a network attack vector (AV:N), low attack complexity (AC:L), and a high confidentiality impact (C:H) that is offset by the requirement for low-level privileges (PR:L) and no integrity or availability impact (I:N/A:N). No EPSS score, KEV listing, or POC reference is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of authenticated-only access and a pure information-disclosure (out-of-bounds read, CWE-125) outcome means this is a confidentiality-only memory-disclosure bug, not a code-execution flaw - consistent with the C:H/I:N/A:N vector. The 'Buffer Overflow' tag is somewhat misleading: CWE-125 is an out-of-bounds READ (disclosure), not a classic overflow write, so defenders should treat this as info-leak, not RCE. Priority is elevated by the ubiquity of the Windows DNS Server role (often co-located on Active Directory domain controllers) and the very broad affected-version matrix; prioritize patching internet-exposed or multi-tenant DNS servers first.

An attacker who already holds low-privilege access to a network position able to reach the Windows DNS Server service sends a specially crafted request that triggers an out-of-bounds read, causing the service to return adjacent process memory. The disclosed memory could contain sensitive data such as cached records, configuration, or memory fragments useful for follow-on attacks. No public proof-of-concept exploit is identified in the provided data, and low attack complexity (AC:L) means a working exploit would be reliable once developed.