EUVD-2026-73608
GHSA-c4vx-3v55-8jhq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local authenticated access with low privileges suffices to read uninitialized memory; no integrity or availability impact is present.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally.
AnalysisAI
Local information disclosure in the Windows DNS component affects multiple Microsoft Windows Server versions from 2012 through 2025. An authorized local attacker with low privileges can trigger an uninitialized resource condition (CWE-908) in the DNS service, potentially reading stale memory contents that may include DNS query data, internal server state, or other sensitive in-process information. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated local session on the target Windows Server system with at least low-privilege access (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.5 Medium rating reflects a local-only attack path (AV:L) requiring low user privileges (PR:L), substantially constraining the exploitable population compared to network-facing vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Microsoft's security update for the relevant platform via Windows Update or WSUS, targeting the following patched build floors: Windows Server 2012 → 6.2.9200.26349, Windows Server 2012 R2 → 6.3.9600.23397, Windows Server 2016 and Windows 10 1607 → 10.0.14393.9512, Windows Server 2019 and Windows 10 1809 → 10.0.17763.9245, Windows Server 2022 → 10.0.20348.5622, Windows Server 2025 → 10.0.26100.33438. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today