Windows DNS EUVD-2026-56742

The attacker must hold a valid, low-privileged local user account on the target Windows system - confirmed by CVSS PR:L and the Microsoft description's use of 'authorized attacker.' Remote unauthenticated exploitation is explicitly excluded by the AV:L vector. The vulnerability is not limited to systems running the DNS Server service role, as the affected CPE strings include Windows 10 desktop editions where only the DNS client is present. No specific non-default configuration trigger is documented; the flaw appears to reside in a code path reachable by any locally authenticated standard user interacting with DNS functionality. Exploitation is limited to attackers with existing local session access - network perimeter controls, while necessary, do not mitigate this flaw if internal users or compromised accounts are present.

CVSS 7.8 with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a straightforward local privilege escalation requiring only a standard user account and no user interaction, with low attack complexity once access is established. However, the real-world exploitation signal is subdued: EPSS sits at 0.26% (17th percentile), and SSVC classifies exploitation status as 'none' with automatable set to 'no' - both consistent with the local-only attack vector that prevents opportunistic internet-scale targeting. The SSVC 'technical impact: total' rating is the key threat signal, confirming that any successful exploitation yields unrestricted system access. There is no discrepancy between the local attack vector and the description; both specify local authorized attacker access. The absence from CISA KEV and no POC availability at time of analysis further indicate this is not currently being weaponized. Priority should be determined primarily by the attacker's ability to obtain initial local access in the target environment - organizations with strong endpoint controls and limited local account exposure face meaningfully lower residual risk.

An attacker who has compromised or been granted a standard user account on a target Windows system submits a crafted DNS request or manipulates DNS-related data in a way that triggers the integer wraparound in the Windows DNS component, causing an undersized heap buffer to be allocated and subsequently overflowed. The controlled heap corruption is leveraged to overwrite security-critical data structures, escalating execution privileges from a low-privileged user context to SYSTEM. No public exploit code exists at time of analysis, so exploitation currently requires the attacker to independently develop the heap corruption primitive.