CVE-2026-62787

The 'authorized attacker' qualifier on this DNS Server use-after-free creates a misleading impression of limited risk. In practice, 'authorized' means any domain-authenticated principal — every user account, service account, workstation, and compromised endpoint that can reach port 53. That population is trivially satisfied by anyone who has achieved any initial foothold in the environment, making the CVSS 7.5 a poor proxy for actual exploitability. The EPSS score of 0.0051 reflects this reality: the probability of active exploitation is non-trivial precisely because the authorization threshold is so easily cleared. An attacker with domain-user access doesn't need to escalate privileges to trigger this — they already have the credentials required to send DNS queries to the server. What makes this significant is the structural position of DNS in Windows environments. Compromising the DNS server doesn't give you code execution on one host — it gives you the ability to redirect authentication, poison service discovery, and intercept inter-service communication across the entire domain. The blast radius of a DNS compromise is systematically disproportionate to its CVSS rating, and this CVE should be treated as a potential domain-wide pivot rather than a medium-severity service bug. The use-after-free classification matters because it enables heap manipulation. An attacker who can trigger specific DNS query sequences may be able to reclaim freed memory with controlled data and achieve code execution at SYSTEM or NetworkService privilege level. The technical barrier is not high for a competent attacker with a domain foothold. Prioritize patching this CVE aggressively. The risk isn't that an external attacker will exploit it — it's that an attacker who has already established presence elsewhere in the domain will use it as a lateral movement or privilege escalation tool. The authorization requirement is not a meaningful security boundary in most enterprise deployments.

Reviewed through automated stages and approved by a human before publication.