Executive brief
A security vulnerability exists in the Microsoft Windows DNS Server, which is responsible for translating human-readable domain names into IP addresses. An authorized attacker with high-level permissions could exploit this flaw to execute malicious code on the server. This could lead to a complete takeover of the server, potentially compromising the entire network's directory services and data integrity.
Technical details
A use-after-free vulnerability (CWE-416) exists within the Microsoft Windows DNS Server component. The flaw is triggered when the server incorrectly manages memory during the processing of specific DNS requests, allowing an attacker to reuse a memory pointer after it has been freed. To exploit this, an attacker requires high privileges and must overcome high attack complexity, likely involving specific timing or race conditions. Successful exploitation allows for remote code execution (RCE) with the privileges of the DNS service, potentially leading to a full system compromise. Microsoft has released security updates to address this issue in Windows Server 2025.
Affected products
- Microsoft Windows Server 2025 10.0.26100.0 to 10.0.26100.33158
- Microsoft Windows Server 2025 (Server Core installation) 10.0.26100.0 to 10.0.26100.33158
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory: Microsoft published the security update guide.