Windows DNS Server CVE-2026-97820

Exploitation requires the target host to be running the Windows DNS Server role and requires the attacker to already hold low-level authorization (PR:L) with a network path to the DNS service; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factor is the authentication/authorization prerequisite - this is not an unauthenticated remote flaw - so realistic risk is highest where low-privilege accounts or internal network footholds can reach the DNS Server. Impact is confined to information disclosure (C:H, I:N, A:N); it does not enable code execution, data modification, or denial of service.

This is a moderate-severity information-disclosure flaw (CVSS 6.5) in the Windows DNS Server role. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring low-level privileges (authenticated attacker), with high confidentiality impact (C:H) but no integrity or availability impact (I:N/A:N) - consistent with an out-of-bounds read (CWE-125) that leaks memory contents rather than enabling code execution. No EPSS score was provided in the input, and the vulnerability is NOT listed in CISA KEV; no public exploit code is referenced. The description states 'authorized attacker,' which aligns with the CVSS PR:L metric, so these signals are consistent rather than conflicting. Overall this is a real but mid-tier priority: the attack vector is network-based and complexity is low, but the requirement for prior authorization and the confidentiality-only impact (memory disclosure, not RCE) reduce real-world urgency. It should be patched in the normal cycle, prioritized where the DNS Server role is internet-exposed or where low-privilege access is broadly available, but it is not a drop-everything emergency absent evidence of active exploitation. Note: EPSS data is missing, so exploitation-probability cannot be quantified from the input.

An attacker who already holds low-level authorized access to a network path reaching the Windows DNS Server sends crafted DNS queries or data that trigger an out-of-bounds read in the server's parsing logic. The server returns or exposes adjacent memory contents, potentially leaking sensitive data such as cached records, configuration, or memory fragments useful for further attacks. No public proof-of-concept is identified in the provided data, and low attack complexity (AC:L) means a reliable trigger is plausible once the required access exists.