Windows DNS Server CVE-2026-97823

Exploitation requires the target host to be running the Windows DNS Server role (not present on default client installs or servers without the DNS role), and the attacker must hold low-privilege authorized access to interact with the service (PR:L) - it is NOT remote-unauthenticated. No user interaction is required (UI:N) and no special non-default configuration beyond having the DNS Server role enabled is indicated. Limiting factors: the mandatory authentication/authorization prerequisite and the disclosure-only impact (no integrity or availability effect) constrain realistic risk; the flaw leaks memory rather than granting code execution. Affected builds span Windows Server 2012 through Server 2025 and Windows 10/11, each fixed in the specific patched build listed by EUVD.

This is a medium-severity (CVSS 6.5) out-of-bounds read in Windows DNS Server. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is internally consistent with the description's 'authorized attacker ... over a network': AV:N confirms network reach, AC:L indicates no special timing/conditions, and PR:L confirms authentication is required (matching 'authorized attacker'). Impact is confidentiality-only (C:H/I:N/A:N), consistent with CWE-125 information disclosure rather than code execution. No EPSS score was provided, the CVE is NOT on CISA KEV, and no public POC is indicated - so there is no public exploit identified at time of analysis. The requirement for prior authorization (PR:L) meaningfully lowers real-world risk versus an unauthenticated DNS flaw, making this a moderate-priority patch rather than an emergency: prioritize it on internet-reachable or multi-tenant DNS servers where low-privilege access is plausible, but it does not carry the drop-everything urgency of a KEV-listed or unauthenticated-RCE DNS issue. Note the 'Buffer Overflow' tag is imprecise - CWE-125 describes a buffer over-READ (disclosure), not a classic overflow write, and the C:H/I:N/A:N vector supports disclosure-only, not memory corruption.

An attacker who already holds low-privilege authorized access (e.g., a foothold permitting authenticated DNS interaction) sends a crafted request to the Windows DNS Server that triggers an out-of-bounds read, causing adjacent process memory to be returned in the response. Given AC:L, no special timing is needed, but PR:L means the attacker must first obtain valid low-level credentials or access. No public exploit code is identified at time of analysis.