Windows DNS Server CVE-2026-97824

Exploitation targets the Windows DNS Server role and requires the attacker to already possess low-level privileges (PR:L) to interact with the service over the network - it is NOT anonymous/unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the authentication/privilege prerequisite: a completely unauthenticated remote actor cannot trigger it per the CVSS vector. Impact is confined to information disclosure (C:H) with no integrity or availability effect, so the realistic risk is memory/data leakage rather than code execution or denial of service. Affected systems are those running vulnerable Windows Server (2012 through 2025) or Windows 10/11 builds below the fixed versions listed in EUVD that host the DNS Server component.

This is a moderate-priority, not high-urgency, issue. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, information-disclosure flaw that nonetheless requires the attacker to already hold some privilege (PR:L) on or toward the DNS service - so it is an authenticated attack, not an anonymous internet-facing one. Impact is confidentiality-only (C:H, I:N, A:N): memory may be leaked but data cannot be altered and the service is not crashed. No EPSS score, KEV listing, or POC was provided in the input, so there is no positive signal of active or imminent exploitation; per precision rules this is 'no public exploit identified at time of analysis.' The signals are internally consistent (an out-of-bounds read, CWE-125, maps cleanly to a confidentiality-only disclosure), with no network-vs-local contradiction. Net assessment: a legitimate patch-in-normal-cycle item for Windows DNS operators, elevated by the ubiquity of the affected product but tempered by the authentication prerequisite and the absence of any exploitation evidence.

An attacker who can already reach and interact with the Windows DNS Server service with low-level privileges sends specially crafted DNS data that triggers an out-of-bounds read in the server's parsing logic, causing it to return adjacent process memory. The leaked bytes could expose sensitive in-memory data such as cached records, configuration fragments, or values useful for chaining into a further attack. No public proof-of-concept was identified in the provided data, and exploitation requires existing low-level privileges rather than anonymous network access.