Windows DNS Server CVE-2026-97821

Exploitation targets the Windows DNS Server role specifically; a host must have the DNS Server feature installed and reachable over the network. The CVSS vector requires low-level privileges (PR:L), so the attacker must be an authorized party able to interact with the DNS service - this authentication requirement is the primary limiting factor and means default unauthenticated internet exploitation is not indicated. No user interaction is required (UI:N) and attack complexity is low (AC:L). Impact is confined to confidentiality (memory/information disclosure, C:H); there is no integrity or availability impact (I:N/A:N), so the flaw does not by itself enable code execution or denial of service. Affected systems span Windows Server 2012 through Server 2025 and Windows 10/11, remediated by the vendor-supplied fixed build numbers listed in EUVD.

This is a moderate-severity information disclosure flaw (CVSS 6.5) in the Windows DNS Server role. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N indicates a network-reachable, low-complexity attack requiring low-level privileges (PR:L), with high confidentiality impact (C:H) and no integrity or availability impact. The description's phrase 'authorized attacker' is consistent with the PR:L metric, so exploitation is NOT unauthenticated - an attacker must already hold some valid privilege or authenticated access to the service. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public proof-of-concept is referenced, so there is no evidence of active exploitation or available exploit code. No SSVC decision data was supplied. Taken together, the signals describe a real but not emergency-priority issue: the network attack vector and high confidentiality impact warrant patching, but the authentication requirement (PR:L), absence of KEV/POC evidence, and memory-disclosure-only impact (out-of-bounds read, not RCE) place this below critical. Treat as a standard prioritized patch for internet- or network-exposed Windows DNS servers rather than an out-of-band emergency.

An attacker who already holds low-level authorized access that can issue requests to a vulnerable Windows DNS Server sends specially crafted queries that trigger an out-of-bounds read in the DNS parsing logic. The server returns or leaks adjacent process memory, potentially disclosing sensitive in-memory data over the network. No public exploit code is referenced, and the attack requires valid privileges (PR:L), limiting opportunistic use.