Windows DNS EUVD-2026-73634

The Windows DNS Server service (dns.exe) must be installed and running - this is not enabled by default on all Windows systems but is present on all Active Directory domain controllers and dedicated DNS infrastructure. The attack is unauthenticated (PR:N) and requires no user interaction, but AC:H indicates a specific memory-state condition must be achieved, likely involving a particular DNS query type, record type, or processing sequence. Exploitation is limited by: (1) AC:H complexity requiring reliable heap state manipulation under ASLR/CFG mitigations; (2) the DNS Server role must be active on the target; (3) network access to port UDP/53 or TCP/53 is required - many internal DNS servers are not internet-facing, which limits exposure to network-adjacent or authenticated-perimeter attackers in those deployments.

The CVSS 8.1 score with AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H accurately reflects a high-impact but non-trivial-to-exploit vulnerability. AC:H is the critical differentiator: use-after-free vulnerabilities generally require a specific memory-state race or crafted allocation sequence that may be difficult to reliably trigger across heterogeneous patch levels and kernel ASLR configurations. Despite AC:H, the attack surface is broad - DNS servers (UDP/53, TCP/53) are almost universally network-accessible in enterprise environments and frequently exposed at perimeter or internal infrastructure layers. No EPSS score, KEV status, or public POC is available in the provided intelligence, making current exploitation risk indeterminate from automated signals. The wide version range across Windows Server 2012-2025 suggests a long-standing code path affected, elevating the real-world patch surface. Defenders should treat this as a high-priority patch on internet-facing DNS servers and authoritative Active Directory DNS infrastructure. The 'Denial Of Service' tag understates the disclosed impact; the vendor description explicitly confirms code execution, not merely availability disruption.

An unauthenticated attacker with network access to a Windows Server DNS endpoint sends a sequence of crafted DNS packets engineered to trigger a race condition or specific allocation sequence that frees a DNS record object while a dangling reference remains active. The attacker then sprays controlled data to occupy the freed memory region and redirects execution flow, achieving arbitrary code execution in the context of the DNS service (typically SYSTEM). No public POC is available at time of analysis; exploitation requires crafting the precise packet sequence and memory layout.