Windows DNS Server EUVD-2026-73275

The Windows DNS Server role must be installed and active on the target system - this role is not enabled by default on standard Windows Server installations but is ubiquitous on Active Directory domain controllers. The service listens on UDP/53 and TCP/53; the attacker requires network connectivity to those ports. No authentication is required (PR:N). AC:H indicates a race condition or specific heap-state prerequisite must be satisfied, meaning reliable exploitation likely requires multiple crafted DNS requests in a precise order or timing window. Exploitation is not limited to local networks - any host with routable access to port 53 on the target can attempt it, including from the Internet if the DNS server is publicly reachable. Windows 10 clients (Version 1607, 1809) are only affected if the DNS Server feature/role is explicitly installed, which is non-default on workstation SKUs.

Real-world risk is significant but tempered by the AC:H requirement. CVSS AV:N/PR:N/UI:N confirms that exploitation is network-reachable without authentication - any host that can send DNS queries to the server is a potential attacker, including Internet-facing recursive resolvers. However, AC:H indicates a race condition or specific heap layout precondition, meaning exploitation is not trivially reliable and likely requires multiple attempts or a crafted sequence. There is no KEV listing and no public proof-of-concept identified at time of analysis; EPSS data is not provided. Given that Windows DNS Server is a high-value target in Active Directory environments (domain controllers typically host it), a working exploit would be highly impactful. The combination of no-auth, network-accessible attack surface, and SYSTEM-level code execution warrants prioritization in environments where the DNS Server role is exposed, particularly to untrusted networks. The AC:H metric is the primary mitigating factor versus a critical-tier vulnerability.

An attacker sends a sequence of specially crafted DNS protocol messages to a Windows DNS Server's UDP/TCP port 53, triggering a use-after-free condition in the DNS request-handling code. By manipulating heap allocation timing - potentially through multiple interleaved DNS requests - the attacker reclaims the freed memory region with attacker-controlled data and redirects execution flow. Successful exploitation achieves SYSTEM-level code execution on the DNS server, which in most AD environments is a domain controller, enabling full domain compromise. No public exploit code identified at time of analysis.