CVE-2026-65798

The CVSS 6.7 assigned to this Windows DNS truncation vulnerability obscures a critical reality: any domain user with the ability to query or manage a DNS server co-located on a domain controller holds a practical path to domain-wide compromise. The truncation error—likely a narrowing conversion from 64-bit to 32-bit—sits in privileged code where successful exploitation grants local SYSTEM privileges. On a domain controller, that local elevation translates directly to domain-level control because the DNS service runs with high privileges and shares trust relationships with Active Directory Domain Services. The CVSS framework treats the step from authenticated user to local SYSTEM as a single bounded escalation, but that model breaks completely when the target is a domain controller—the distance collapses to zero. The 'authorized attacker' qualifier warrants hard scrutiny. If the truncation lives in the DNS query resolution path, any workstation that can query the DNS server exercises the vulnerable code path, making 'authorized' a technical distinction without a practical security boundary. If it lives in the RPC management interface, exploitation requires authenticated API access—but that still means any domain user account, not a privileged administrator. This distinction matters for prioritization but does not materially reduce risk on infrastructure where DNS and AD DS co-exist. Defenders should treat this as a high-priority patch regardless of the medium severity score. The EPSS score of 0.00256 likely reflects low visibility into working exploits rather than genuine difficulty—these bugs cluster in Windows DNS across product generations, and their silent corruption behavior (no crash telemetry) means they persist undetected far longer than crash-inducing flaws. Prioritize DNS servers on domain controllers in your patching queue, even if that means expediting maintenance windows. The operational risk of patching a DNS server is real, but the exposure window between disclosure and remediation is where this vulnerability compounds into systemic risk.

Reviewed through automated stages and approved by a human before publication.