Windows DNS EUVD-2026-56386

The CVSS vector confirms PR:L, meaning the attacker must have some form of network-level authentication - unauthenticated exploitation is not supported by available data. The specific authentication mechanism (e.g., domain user credentials, local account) is not stated in the CVE description or advisory data. AC:H indicates a significant additional technical prerequisite such as a race condition, specific heap layout, or memory state requirement that must be satisfied for the use-after-free to be reliably triggered. The Windows DNS service must be running and network-accessible on the target system; on workstation editions (Windows 10 1607, 1809), this is the DNS client service rather than a full DNS server role. Exploitation is bounded by the requirement for prior low-privilege authentication and high attack complexity - automated or opportunistic mass-exploitation is unlikely under these conditions. Scope remains unchanged (S:U), so exploitation does not inherently allow lateral movement beyond the compromised DNS process.

CVSS 7.5 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H presents a high-impact but complexity-constrained risk profile. The high attack complexity (AC:H) is the primary mitigating factor - use-after-free exploitation typically requires precise heap-grooming, race condition timing, or specific memory layout conditions, reducing the probability of reliable mass exploitation. PR:L confirms low-privilege authentication is required, ruling out fully unauthenticated internet-facing exploitation. The high triad (C:H/I:H/A:H) indicates that successful exploitation yields full compromise of the DNS service, which is critical network infrastructure. No EPSS score is provided in the available data, limiting probabilistic exploitation assessment. The absence of a CISA KEV listing and the lack of any identified POC code further support treating this as a real but not immediately weaponized threat. The unchanged scope (S:U) means the flaw does not inherently allow pivot to adjacent systems. Priority should be elevated for organizations running Windows DNS in exposed or internet-facing configurations, particularly where DNS servers are reachable from lower-trust network segments.

An attacker with low-privilege network credentials - such as a domain user in an enterprise environment - sends a specially crafted DNS request to a vulnerable Windows DNS server to trigger a use-after-free condition in the DNS service's memory management. By precisely timing or grooming the heap to control the freed memory region, the attacker redirects execution to attacker-controlled code, achieving code execution on the DNS server. No public exploit code has been identified at time of analysis, and the high attack complexity implies this scenario requires non-trivial exploit development effort or specific environmental conditions.