Windows DNS EUVD-2026-99865

Exploitation requires the attacker to already hold local, authenticated, low-privileged access to an affected Windows system (AV:L/PR:L) - there is no remote or network-triggerable path. The flaw is in the Windows DNS component and yields information disclosure only (C:H/I:N/A:N), so it cannot by itself execute code or alter data. No user interaction is needed (UI:N). Limiting factors: the local-only vector and the prerequisite of an existing foothold sharply constrain realistic risk, and the read-only impact means it is valuable chiefly as an auxiliary step (e.g. memory/secret leakage) rather than a primary compromise. Affected builds span Windows Server 2012 through Server 2025 and Windows 10 (1607/1809), with fixed versions available from Microsoft.

This is a moderate, low-priority issue rather than an urgent one, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-complexity attack requiring an already-authenticated low-privileged user, yielding high confidentiality impact only (no integrity or availability loss) - i.e. a memory information-disclosure bug. CISA's SSVC framework reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified here. The local attack vector plus the information-only impact (likely leaking adjacent memory contents from the DNS component) means this is primarily useful as a secondary step (e.g. defeating ASLR or harvesting in-memory secrets) rather than a standalone high-value exploit. Net: a legitimately rated medium-severity local info-disclosure flaw with no evidence of real-world exploitation - patch on normal cycle, not emergency.

A low-privileged but authenticated user on a Windows host (typically a Windows Server running the DNS role) triggers the out-of-bounds read in the DNS component to read memory beyond an intended buffer. No public exploit code is identified at time of analysis, and because impact is limited to information disclosure, the most realistic use is leaking memory contents to aid a follow-on local privilege-escalation or to defeat memory protections. There is no user interaction and no network path required.