This critical vulnerability in Microsoft Windows DNS allows unauthenticated remote attackers to execute arbitrary code, posing a severe risk of total system compromise.

The flaw is a heap-based buffer overflow (CWE-122) within the Windows DNS service. It allows an unauthenticated attacker to send crafted packets over the network to trigger memory corruption and execute code in the context of the service.

With a CVSS score of 9.8, this vulnerability represents an imminent threat to network infrastructure. Successful exploitation could lead to full system takeover, lateral movement within the network, and the compromise of sensitive data handled by domain controllers or DNS-dependent servers.

Immediate Action: Apply the vendor-supplied security updates immediately to all affected Windows 11 and Windows Server installations.

Proactive Monitoring: Monitor DNS server logs for anomalous traffic patterns or unexpected service restarts that could indicate crash-looping due to exploitation attempts.

Compensating Controls: Ensure that access to DNS servers is restricted via network firewalls to trusted sources only, minimizing the exposure of the service to the public internet.

Public Exploit Available: Yes — multiple public proof-of-concept repositories exist on GitHub.

Given the critical CVSS severity and the presence of public proof-of-concept material, this vulnerability must be treated as a high-priority patch item. Organizations should verify their current Windows build versions against the provided list and prioritize patching on all internet-facing DNS infrastructure.