Windows DNS EUVD-2026-29684

The vulnerable Windows DNS handling path must be reachable over the network, and the target must run an affected, unpatched build of Windows 11 (22H3-26H1) or Windows Server 2022/2025. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special access are required against affected configurations. The key limiting factor is exposure of the DNS service to the attacker: exploitation requires the ability to deliver crafted DNS messages to the vulnerable component, so hosts whose DNS Server role or resolver is not reachable from the attacker's position are correspondingly harder to reach. The available data does not confirm whether the flaw is in the DNS client resolver (present on all listed Windows versions) or the DNS Server role, which is the decisive deployment condition - verify against the MSRC advisory.

The signals here are in tension and must be weighed rather than taken at face value. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) and the SSVC assessment (Automatable: yes, Technical Impact: total) both argue this is a top-tier, wormable-class network RCE that should be patched urgently. However, the EPSS probability is only 0.07% (21st percentile) and SSVC Exploitation is 'none' - there is no evidence of active exploitation and no public POC, so real-world exploitation is currently theoretical rather than observed. This is a genuine priority for patching due to the low complexity, no-auth network reach, and total impact, but it is NOT currently in CISA KEV and the low EPSS suggests exploitation, if it occurs, has not yet materialized publicly. The main uncertainty: the description does not specify whether the vulnerable code runs in the DNS client resolver (affecting all Windows hosts) or the DNS Server role (affecting servers running the role) - this materially changes exposure and should be confirmed against the MSRC advisory.

An attacker on the network sends specially crafted DNS traffic to a vulnerable Windows host or DNS server, triggering the heap overflow during message parsing and corrupting heap memory to gain control of execution flow. With no authentication or user interaction required and total technical impact, this yields arbitrary code execution in the DNS process context. No public exploit code has been identified at time of analysis, so this scenario is currently theoretical.