Windows DNS Server EUVD-2026-73341

The Windows DNS Server role (dns.exe) must be installed and running on the target - this is not enabled by default on Windows desktop editions or bare Server installations. DNS service must be reachable by the attacker over UDP/53 or TCP/53; for internal AD environments this is typically accessible to all domain-joined hosts. No authentication is required - standard DNS query traffic is unauthenticated. Attack complexity is high (AC:H), meaning exploitation is not reliable without heap-grooming and precise timing to win a race condition or predictably reclaim freed memory. Limiting factors: requires network path to DNS service (port 53); AC:H raises skill bar above script-kiddie level; DNS Server role is not universally installed on all Windows Server deployments.

The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly characterizes this as a serious but not trivially exploitable network RCE. AC:H is the critical mitigating factor: UAF exploitation against a multithreaded DNS daemon requires precise heap-grooming and timing, raising the bar above commodity exploitation. No EPSS score was provided in the input, and neither KEV listing nor public proof-of-concept has been identified, further limiting immediate risk. That said, DNS Server is deployed in nearly every Windows Server Active Directory environment and is routinely exposed on internal networks - often to all hosts on the domain. If an attacker achieves reliable exploitation, impact is catastrophic (full C:H/I:H/A:H on a typically domain-joined server). The mismatch between the 'Denial Of Service' tag and the CVSS C:H/I:H impact signals the tag understates severity - code execution, not just crash, is the primary concern. Priority patching is warranted for internet-facing or perimeter-adjacent DNS servers; internal-only DNS servers should also be patched promptly given lateral-movement scenarios.

An attacker on the same network (or internet, if TCP/53 is exposed externally) sends a sequence of specially crafted DNS query packets designed to trigger a race condition in the DNS Server's query handling code, causing it to access a freed memory region. By pre-grooming the heap with controlled allocations at the freed address, the attacker redirects execution to a shellcode payload, gaining SYSTEM-level code execution on the DNS server host without any credentials. No public proof-of-concept exists at time of analysis, but the AC:H rating indicates exploitation is feasible for a skilled attacker with time to develop a reliable exploit.