EUVD-2026-56622
GHSA-q7cm-j53p-gvff
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Network vector confirmed by DNS service exposure; AC:H for race condition timing requirement; PR:H because exploitation requires authorized high-privilege access per description.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution via race condition in Windows DNS affects authorized, high-privileged attackers across a broad range of Windows Server and Windows client versions. The CWE-362 race condition allows an attacker who already holds elevated credentials to exploit concurrent shared-resource access in the DNS service, achieving full code execution (C:H/I:H/A:H) over the network. No public exploit or CISA KEV listing is identified at time of analysis, and Microsoft has released patches; the PR:H and AC:H constraints substantially limit realistic exploitation.
Technical ContextAI
Windows DNS is Microsoft's DNS server and resolver component, present in both Windows Server roles and some Windows client builds. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) describes a race condition where two or more threads or processes access a shared resource without adequate locking, creating a window for an attacker to manipulate intermediate state. In this case the DNS service's shared resource handling is exploitable at the network level, but only by a principal who has already obtained high-privilege access - consistent with CVSS PR:H. Race condition exploitation typically requires precise timing and repeated attempts, which maps to AC:H. Affected builds span Windows Server 2012 R2 through Windows Server 2025, as well as Windows 10 (1607, 1809) and Windows 11 26H1, indicating the vulnerable code path is present across a wide kernel/service lineage.
RemediationAI
The primary remediation is to apply the vendor-released patches via Windows Update or WSUS, targeting the fixed build numbers per affected release: Windows Server 2025 to 10.0.26100.33296 or later; Windows Server 2022 to 10.0.20348.5499 or later; Windows Server 2019 to 10.0.17763.9115 or later; Windows Server 2016 to 10.0.14393.9418 or later; Windows Server 2012 R2 to 6.3.9600.23337 or later; Windows 10 1607/1809 and Windows 11 26H1 to their respective fixed builds. Consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61920 for the complete patch manifest. Where immediate patching is not possible, limit the pool of principals holding high-privilege access to DNS server hosts, as PR:H is the primary gating factor - reducing authorized elevated accounts directly reduces attack surface. Additionally, network-segment DNS servers so that only authorized management hosts can reach administrative interfaces, reducing the pool of network origins from which a race could be attempted. Note that neither workaround eliminates the vulnerability and patching remains mandatory.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today