Windows DNS Server CVE-2026-97825

Exploitation targets the Windows DNS Server role and requires the attacker to already hold authorized access to the DNS service (CVSS PR:L), so this is not an unauthenticated remote flaw - valid credentials or an existing authorized position on the network are the primary limiting factor. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning once the privilege prerequisite is met the out-of-bounds read can be triggered reliably over the network. Impact is confined to information disclosure (C:H/I:N/A:N); there is no code execution, data modification, or denial of service. Only systems running the affected Windows/Windows Server builds listed in EUVD-2026-100426 with the DNS Server role enabled are exposed.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack, but PR:L means the attacker must already hold some authorized/authenticated access to the DNS service, which meaningfully narrows the threat population versus a PR:N bug. Impact is confidentiality-only (C:H/I:N/A:N): an out-of-bounds read (CWE-125) that leaks memory contents, with no integrity or availability effect. The signals are mutually consistent and point to lower real-world risk: CISA SSVC lists Exploitation as 'none', Automatable 'no', and Technical Impact 'partial'; there is no CISA KEV listing and no public exploit identified at time of analysis. No EPSS score was supplied, so quantitative exploitation probability cannot be stated. In short, this is a credible information-disclosure flaw in a high-value service that warrants timely patching, but the required privileges plus the absence of known exploitation or automation make it a managed-priority item rather than a drop-everything critical.

An attacker who already possesses authorized access to the DNS Server sends crafted queries or requests over the network that trigger an out-of-bounds read, causing the service to return adjacent memory contents in its responses. The leaked data could include sensitive process memory such as cached records, tokens, or other internal state. No public proof-of-concept exploit has been identified, and CISA SSVC assesses exploitation as not observed.