Windows DNS Server EUVD-2026-99613

Exploitation targets the Windows DNS Server role (a server must be running the DNS service and be reachable on the network). Although PR:N marks it unauthenticated, the CVSS UI:R metric means the attack is not fully autonomous: the server must be induced to parse attacker-influenced DNS data (e.g., resolving an attacker-controlled name or processing a crafted response), which is the limiting factor that distinguishes this from a wormable no-interaction flaw. Impact is confined to confidentiality (C:H, I:N, A:N) - a memory over-read disclosure, not code execution or service disruption. Realistic risk is highest for internet-exposed or recursive/forwarding DNS servers and lower for internal, tightly-scoped resolvers; applying the vendor patch to the listed build ranges removes the condition.

This is a moderate-priority information-disclosure flaw rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity, unauthenticated vector with high confidentiality impact but no integrity or availability impact. The single most important mitigating signal is UI:R - exploitation requires some user/operator interaction (e.g., the DNS server being induced to resolve or process attacker-controlled data), which meaningfully lowers the odds of broad, hands-off mass exploitation. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or weaponization; the appropriate status is 'no public exploit identified at time of analysis.' The signals are internally consistent (network OOB read disclosing memory matches CWE-125 and C:H/I:N/A:N), so there is no vector-vs-description conflict to flag. Net: patch on normal cadence for a network-facing Windows DNS role; treat as elevated for internet-exposed or resolver roles, but this is not a drop-everything issue absent KEV/EPSS/POC evidence.

An attacker induces a vulnerable Windows DNS Server to process a maliciously crafted DNS response or query (the UI:R / interaction element), triggering an out-of-bounds read in the DNS parsing code. The resulting over-read leaks adjacent process memory back over the network, potentially exposing sensitive data such as cached records, internal addresses, or memory fragments. No authentication is required (PR:N) and complexity is low (AC:L), but exploitation depends on getting the server to handle the crafted input; no public exploit code is identified at time of analysis.