Windows DNS EUVD-2026-73069

Requires the target to be running the Windows DNS Server role and reachable by the attacker over the network on the DNS service; the CVSS vector (AV:N/PR:N/UI:N) indicates no authentication and no user interaction are needed. Limiting factors: the host must expose the DNS service to the attacker's network position, and successful use-after-free exploitation generally depends on winning a memory-reuse race and reliable heap grooming, which raises practical difficulty above the published AC:L; client-only Windows 10 systems are affected per the version list but are lower-value/less-exposed than servers running the role.

This is a genuine high-priority issue rather than a high-CVSS-but-low-risk case: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes network-reachable, unauthenticated, no-interaction RCE against a role that is frequently internet- or intranet-facing, and Microsoft (secure@microsoft.com) has shipped a patch. No EPSS score, SSVC decision, POC, or KEV entry was supplied, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis; the risk rating here rests on the vector and the criticality of the DNS role, not on observed exploitation. One caveat worth verifying with the vendor: use-after-free bugs typically require winning a race or precise heap grooming, so real-world attack complexity may be higher than the AC:L in the published vector suggests. Because DNS is core infrastructure, any organization running the Windows DNS Server role should treat patching as urgent regardless of whether exploitation has been observed yet.

An attacker sends specially crafted DNS traffic to an exposed Windows DNS Server, driving the vulnerable code path to free and then reuse a memory object under attacker-controlled conditions. By grooming the heap so the freed allocation is replaced with attacker data, they hijack execution and run code in the DNS service context, typically with high privilege on the host. No public exploit is identified at time of analysis, so this scenario is inferred from the CWE-416 class and the network RCE vector.