Windows DNS EUVD-2026-73321

The Windows DNS Server service (dns.exe) must be running on the target host - this role is active by default on Windows Server systems configured as domain controllers or DNS servers, but is not active by default on standard Windows 10 workstation deployments unless explicitly installed via RSAT. No authentication is required; DNS port 53 (TCP/UDP) must be reachable from the attacker. The SSVC 'Automatable: no' rating suggests reliable exploitation may require specific heap state or timing conditions, meaning a single crafted packet may not consistently crash the service without additional preconditions. Exploitation is limited to availability impact only - code execution has not been established. Workstations running Windows 10 1607/1809 are only affected if the DNS Server role has been manually installed.

Despite a CVSS base score of 7.5 (High), several signals collectively de-prioritize this finding relative to its raw score. EPSS is 0.87% (57th percentile), indicating a below-average probability of imminent exploitation in the wild. SSVC rates exploitation as 'none' and automatable as 'no', suggesting that while the attack vector is network-accessible, reliable exploitation may require specific heap layout conditions, making automated mass exploitation unlikely. Technical impact is rated 'partial', meaning DoS rather than code execution. The vulnerability is not in CISA KEV, and no POC is publicly available. Real-world risk is highest for organizations where Windows DNS servers are exposed to untrusted networks (e.g., authoritative DNS on public-facing infrastructure); internal resolvers behind firewall perimeters face lower practical risk. The DoS impact of DNS service disruption should not be underestimated - a crashed DNS server can cause network-wide name resolution failures, indirectly affecting all network-dependent services in an Active Directory or enterprise environment.

An unauthenticated attacker sends a specially crafted DNS query or sequence of DNS packets over the network to a vulnerable Windows DNS server on port 53. The malformed input triggers a use-after-free condition in the DNS service memory heap, causing the dns.exe process to crash and rendering the server unable to resolve DNS queries. In an Active Directory environment, this would disrupt domain authentication and all network services dependent on name resolution until the service is manually restarted or the system is rebooted.