The heap overflow in Windows DNS (CVE-2026-70304) carries more risk than its CVSS 6.7 rating suggests. The vulnerability allows local privilege escalation to SYSTEM, but the critical detail is where this escalation occurs. In most enterprise environments, DNS servers are co-located with or directly connected to Domain Controllers, meaning a successful exploit can move from local SYSTEM to domain-admin-equivalent access. That's the escalation path that matters.
The 'authorized attacker' prerequisite in the description is doing significant work. In Active Directory environments, DNS service accounts routinely operate with forest-level permissions to enable proper resolution and replication. The boundary between 'authorized domain user' and 'has the access needed to trigger this vulnerability' is far narrower than the CVSS vector implies. Historical analysis supports this: CVE-2020-1350 and CVE-2021-24069 received similar 'medium, authorized attacker' framing that collapsed in practice when attackers chained them with credential relay tooling.
Beyond the immediate exploit, DNS functions as a critical chokepoint. Every authentication protocol—Kerberos, NTLM, LDAPS—depends on DNS returning correct results. Compromising a DNS server doesn't just yield local privileges; it poisons the resolution infrastructure that all other security controls assume is trustworthy. The CVSS rating measures exploitability; it cannot capture this blast radius.
Organizations should prioritize patching DNS servers faster than their standard 14-30 day window for medium-severity CVEs. The compounding risk lies in forgotten secondary resolvers, branch office configurations, and test domains from migrations that remain untracked and unpatched long after the primary infrastructure receives updates.