Windows DNS Server CVE-2026-97817

Requires the Windows DNS Server role to be installed and running, and the attacker must be an authorized (authenticated, low-privilege) actor with network reachability to the DNS service, per CVSS PR:L and the 'authorized attacker' wording. Exploitation does NOT require user interaction (UI:N) or high privileges, and complexity is low (AC:L), but the privilege requirement and confidentiality-only impact (no integrity or availability effect) limit realistic damage to information disclosure of server memory. Affected deployments are unpatched Windows Server 2012/2012 R2/2016/2019/2022/2025 and Windows 10/11 builds below the fixed versions listed in EUVD-2026-100419; systems not running the DNS Server role are not exposed.

CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network-reachable, low attack complexity, but requiring low-level privileges (PR:L, an 'authorized attacker' per the description) and yielding confidentiality impact only (C:H, I:N, A:N). This is an information-disclosure heap-overflow (CWE-122) in the Windows DNS Server role, not a remote-code-execution or denial-of-service issue, which caps its severity despite the memory-corruption root cause. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. A vendor patch is available from Microsoft (MSRC advisory), which is the strongest confirmed signal here. On balance this is a real-but-moderate priority: the authentication requirement and confidentiality-only impact argue against emergency treatment, but the network vector, low complexity, and the broad, security-sensitive DNS Server attack surface across the full supported Windows Server fleet justify patching on a normal-to-expedited cycle. Note the tension between the generic MSRC description ('authorized attacker') and the lack of any exploitation telemetry - treat exploitability as inferred from the CVSS vector, not confirmed.

An attacker who already holds low-privilege authenticated access reachable to the DNS service sends a crafted query or request that triggers a heap-based buffer overflow in the Windows DNS Server, causing it to read and return out-of-bounds heap memory. Because impact is confidentiality-only (C:H/I:N/A:N), the attacker leverages this to disclose sensitive process memory contents over the network rather than to execute code or crash the service. No public proof-of-concept was identified at time of analysis, and the low attack complexity (AC:L) means a working exploit, if developed, would be reliable.