Windows DNS EUVD-2026-56394

The attacker must be positioned on a network adjacent to the target - meaning the same Layer-2 segment, VLAN, or subnet (AV:A per CVSS). This is not remotely exploitable from the internet without a prior adjacent-network foothold such as a VPN connection, compromised internal host, or shared wireless network. No authentication is required (PR:N) and no user interaction is needed (UI:N). The Windows DNS service - either the DNS Server role (on Windows Server) or the DNS client resolver (present on all Windows versions including Windows 10/11) - must be running, which is the default state on all affected platforms. Exploitation is not limited to domain controllers; Windows 10/11 desktop systems with the DNS client are also affected. The key limiting factor is the adjacency requirement: external internet-sourced attacks are not possible without a bridging foothold.

The CVSS 8.8 rating is driven by AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - a highly impactful but adjacency-constrained vulnerability. The most significant risk mitigant is the adjacent network requirement (AV:A): exploitation cannot originate from the open internet without prior foothold on the same network segment. However, in enterprise environments, Active Directory-integrated Windows DNS Servers are widely deployed in data center segments shared by many internal hosts, substantially broadening the realistic threat surface. Windows 10/11 clients are also affected, suggesting the DNS client resolver may be the attack surface, in which case a rogue DHCP/DNS server on a shared Wi-Fi or LAN segment could target end-user machines. No EPSS data was provided, and no KEV listing or POC availability was indicated in the supplied intelligence, making real-world exploitation status unconfirmed. The patch is available from Microsoft, which reduces residual risk for patched systems. Unpatched Windows DNS Server deployments in internal segments should be treated as high-priority given the no-auth, no-interaction exploitation path.

An attacker positioned on the same subnet as a Windows DNS Server - for example, a compromised workstation in the same office VLAN or an attacker on a shared Wi-Fi network - sends a specially crafted DNS packet designed to trigger the out-of-bounds write in the DNS service. The memory corruption overwrites control flow data, redirecting execution to attacker-controlled code. Because no authentication or user interaction is required, this attack can be fully scripted once an adjacent network position is established. No public exploit code has been identified at time of analysis.