CVE-2026-69672: Windows DNS Information Disclosure Flaw

CVE-2026-69672 Overview

CVE-2026-69672 is an information disclosure vulnerability in the Windows Domain Name System (DNS) component. The flaw stems from the use of an uninitialized resource [CWE-908], allowing an authorized local attacker to read memory contents that should not be accessible. Microsoft published the advisory on September 8, 2026, and classified the issue with a CVSS 3.1 base score of 5.5.

Exploitation requires local access and low privileges but no user interaction. A successful attack exposes confidential data resident in DNS process memory, which may include DNS query state, cached records, or other in-process artifacts useful for further attack staging.

Critical Impact
An authenticated local attacker can read uninitialized memory from the Windows DNS component, disclosing sensitive in-process data without altering system integrity or availability.

Affected Products

Microsoft Windows (DNS component) — see the Microsoft Security Update Guide for the authoritative list of affected builds
Windows Server installations running the DNS role
Windows client editions containing the affected DNS client/service code

Discovery Timeline

2026-09-08 - CVE-2026-69672 published to NVD
2026-09-08 - Microsoft releases security update guidance
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-69672

Vulnerability Analysis

The vulnerability is categorized as Use of Uninitialized Resource [CWE-908] within the Windows DNS code path. When the affected function allocates a buffer or structure but does not fully initialize it before returning data to a caller, residual memory contents remain accessible. An authorized local user can trigger the vulnerable code path and observe the leaked bytes.

The CVSS vector indicates a confidentiality-only impact with no effect on integrity or availability. The attack is local, meaning the attacker must already have a foothold on the target host, either interactively or through code execution as a low-privilege account.

Because DNS handles name resolution requests across the host and, on server SKUs, across the network, uninitialized memory disclosed through this component may contain fragments of prior DNS transactions, pointers useful for bypassing Address Space Layout Randomization (ASLR), or other process state that assists follow-on exploitation.

Root Cause

The root cause is a code path in the Windows DNS component that returns or serializes a memory region without zero-initialization or complete population of all fields. Padding bytes in structures and unwritten portions of stack or heap allocations retain prior contents, which are then exposed to the caller. This class of defect commonly arises from missing memset or RtlZeroMemory calls, or from struct-copy operations that include uninitialized padding.

Attack Vector

Exploitation requires local access with low privileges (PR:L) and no user interaction. An attacker invokes the affected DNS interface — for example, through a local API, IOCTL, or service RPC endpoint reachable from a low-privileged context — and captures the returned buffer. Repeated invocations can be used to sample memory over time and reconstruct sensitive material.

No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.396%, indicating a low near-term probability of observed exploitation.

Refer to the Microsoft Security Update Guide entry for the technical description and patch metadata.

Detection Methods for CVE-2026-69672

Indicators of Compromise

No file-based or network IOCs have been published for this vulnerability given its local information-disclosure nature.
Unexpected local processes repeatedly querying DNS service interfaces or RPC endpoints from low-privileged user contexts.
Anomalous handle acquisition against dns.exe or related DNS client service objects by non-administrative accounts.

Detection Strategies

Monitor for local invocations of DNS management or diagnostic APIs from unexpected user contexts and non-standard binaries.
Alert on missing security updates for the Windows DNS component through vulnerability management scanning.
Correlate low-privilege process activity that interacts with DNS interfaces alongside subsequent privilege-escalation or lateral-movement indicators.

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) and command-line logging to observe callers of DNS utilities such as dnscmd.exe and PowerShell DnsClient cmdlets.
Track service-level telemetry for dns.exe on DNS servers, including RPC call patterns from non-administrative principals.
Ingest endpoint telemetry into a centralized analytics platform to baseline normal DNS interface use and surface deviations.

How to Mitigate CVE-2026-69672

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-69672 to all affected Windows client and server systems.
Prioritize patching on Windows Servers running the DNS role and on multi-user hosts where low-privileged accounts are present.
Review local account inventory and remove unnecessary interactive logon rights on DNS servers.

Patch Information

Microsoft has published patch details in the Security Update Guide entry for CVE-2026-69672. Administrators should consult the advisory for the current list of affected builds and corresponding cumulative update KB numbers, then deploy through Windows Update, Windows Server Update Services (WSUS), or the organization's endpoint management tooling.

Workarounds

No vendor-published workaround exists; patching is the supported remediation.
Restrict interactive and remote logon on DNS servers to administrative personnel to reduce the population of accounts capable of triggering the local attack path.
Enforce least privilege on service accounts and end-user workstations to limit which principals can invoke the affected DNS interfaces.

bash

# Verify installed Windows updates on an affected host
wmic qfe list brief /format:table

# PowerShell equivalent to check for the KB referenced in the MSRC advisory
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20