Windows DNS EUVD-2026-99176

Exploitation requires the target to be running the Windows DNS Server role (affected builds span Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 and Windows 10 Version 1607/1809), and the attacker must hold valid low-privilege authenticated access to reach the service over the network (PR:L) - it is NOT remote-unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The principal limiting factors are the authentication requirement and the impact ceiling: the flaw yields only a denial of service (A:H) with no code execution, data disclosure, or integrity loss, which bounds realistic worst-case impact to availability of DNS resolution.

All exploitation signals converge on a modest, non-urgent risk despite the network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) shows the only impact is availability (A:H) - a denial of service - with no confidentiality or integrity loss, and it requires an authenticated low-privilege attacker (PR:L), not an anonymous one. CISA's SSVC framework reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial, i.e. no observed exploitation and no mass-scan weaponization potential. This is not in CISA KEV and no public exploit code is identified. No EPSS probability was provided in the input, so quantitative exploitation likelihood cannot be stated. In short, this is a legitimately-rated medium issue, not a high-CVSS-but-overstated finding, but neither is it a patch-tonight emergency; the combination of authentication requirement, DoS-only impact, and 'none' exploitation status places it in routine patch-cycle territory. Note a metadata conflict: the input Tags list 'Information Disclosure', yet the CVSS vector sets C:N and the description states denial of service - there is no confidentiality impact, so that tag is inconsistent with the authoritative data.

A low-privileged but authenticated attacker on the network sends a specially crafted request to a Windows DNS Server, triggering an out-of-bounds read (CWE-125) in the DNS service. The malformed input causes the service to read beyond allocated memory and crash, interrupting name resolution for dependent clients. No public exploit code has been identified at time of analysis.