Microsoft Windows DNS EUVD-2026-35643

Attacker must already have local code execution on the target Windows host with at least low-privileged (standard user) credentials and must be able to reach the vulnerable Windows DNS code path on that machine - no remote network exploitation is described by the CVSS vector (AV:L). Exploitation is further limited by high attack complexity (AC:H), which typically means the attacker must win a race condition or precisely groom the heap, making reliable exploitation non-trivial and reducing risk on hardened, single-user systems while elevating it on shared/multi-user hosts such as RDS, Citrix, or jump servers. No user interaction is required (UI:N) once the attacker has their foothold.

The CVSS vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H paints a constrained but high-impact picture: an attacker already on the host with at least low privileges, willing to overcome non-trivial preconditions (AC:H - likely heap-grooming or race timing), can fully compromise confidentiality, integrity, and availability. There is no EPSS score, no KEV listing, and no POC referenced - exploitation status is best characterized as no public exploit identified at time of analysis. Practically this is a post-compromise privilege-escalation primitive rather than an internet-facing emergency; however, on multi-user systems, Citrix/RDS hosts, and Windows Servers where standard users can reach the DNS service, it remains a high-priority patch because heap overflows in core OS components are historically weaponizable once samples emerge. No conflicting signals were observed, but EPSS and KEV data are absent from the input, so real-world exploitation prevalence is unknown.

An attacker who has already obtained low-privileged code execution on a Windows host - for example via a phishing payload run as a standard user on a workstation, or a compromised service account on a member server - triggers a specially crafted interaction with the local Windows DNS component to overflow a heap buffer. After winning the heap-layout race implied by AC:H, the corruption is leveraged to hijack control flow inside a SYSTEM-context routine, granting full administrative rights on the machine. No public POC is referenced, so this scenario is currently theoretical but consistent with prior Windows DNS heap-overflow exploitation patterns.