Windows DNS Server CVE-2026-97819

Exploitation requires the target host to be running the Windows DNS Server role and reachable over the network, plus low-privilege authenticated access to the attacker (CVSS PR:L) - it is NOT remote-unauthenticated. The specific triggering feature is not detailed in the vendor description beyond an out-of-bounds read reached via a network request to the DNS service. Limiting factors: an attacker must first possess valid low-level credentials/authorization (PR:L), impact is confined to information disclosure (C:H, I:N, A:N) with no code execution or denial of service, and only hosts actually running the DNS Server role (not all Windows systems) are affected; patched builds listed in EUVD remediate the issue.

This is a medium-severity information disclosure flaw (CVSS 6.5) in the Microsoft Windows DNS Server role, stemming from an out-of-bounds read (CWE-125). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates network-reachable, low-complexity exploitation that requires an authenticated attacker (PR:L), with high confidentiality impact but no integrity or availability impact - consistent with a memory over-read that leaks data rather than enabling code execution or service disruption. Exploitation status: no public exploit identified at time of analysis; this CVE is NOT on CISA KEV and no POC is referenced in the provided sources. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. On balance this is a moderate, not top-tier, priority: the combination of required authentication (PR:L), confidentiality-only impact, and absence of any exploitation or POC signal argues against emergency treatment, but the network attack vector, low complexity, a Microsoft-issued patch, and broad Windows Server footprint justify prompt patching in DNS-serving environments. Note the 'Buffer Overflow' tag is imprecise - the actual defect per CWE-125 and the description is an out-of-bounds READ (over-read/info leak), not a buffer overflow write.

An attacker who already holds low-privilege authenticated access reachable to the DNS service sends a crafted query or request to a vulnerable Windows DNS Server, triggering an out-of-bounds read that returns adjacent process memory in the response. The leaked memory could contain sensitive data such as DNS internals or other process secrets. No public proof-of-concept is identified at time of analysis, and low attack complexity (AC:L) means no special timing or race conditions are required once access is obtained.