Windows DNS Server EUVD-2026-99168

The target must be running the Windows DNS Server role and be network-reachable by the attacker (the flaw is in DNS Server, so a host without that role installed is not affected). No authentication and no user interaction are required (PR:N/UI:N). The primary limiting factor is the high attack complexity (AC:H): successful use-after-free exploitation depends on winning a race or achieving a specific memory/heap state, which reduces reliability and makes mass automated exploitation unlikely (SSVC Automatable: no). No special non-default DNS configuration is named in the description beyond the DNS Server role being active.

This is a genuinely serious but not emergency-tier issue. The CVSS vector (AV:N/PR:N/UI:N) confirms remote, unauthenticated, no-user-interaction reach, and the CWE-416 use-after-free yields total technical impact (C:H/I:H/A:H) - consistent with SSVC's 'Technical Impact: total'. However, AC:H is the key limiter: exploitation requires high attacker effort (typically winning a race or achieving a specific heap/memory state), which is why CISA SSVC rates Exploitation as 'none' and Automatable as 'no'. No EPSS score was supplied, and there is no CISA KEV listing and no referenced public POC, so there is no evidence of active exploitation or wormability. The signals are therefore mutually consistent rather than conflicting: high potential impact tempered by high attack complexity and no exploitation-in-the-wild evidence. Treat as a high-priority patch for internet-facing or widely-reachable Windows DNS servers, but not a drop-everything zero-day. Note: EPSS data is entirely absent from the input and cannot be assessed.

A remote attacker who can reach the Windows DNS Server service (e.g., an internet-exposed or internal recursive/authoritative resolver) sends specially crafted DNS traffic that triggers a use-after-free in the server's memory handling. By grooming the heap and winning a timing-sensitive condition (reflected in the high attack complexity), the attacker reuses the freed object to execute arbitrary code in the service context. No public exploit identified at time of analysis, so reliable weaponization would require independent development.