Windows DNS Server CVE-2026-97826

Exploitation requires the DNS Server role to be installed and running on an affected Windows build (e.g., Windows Server 2012/2012 R2/2016/2019/2022/2025 and Windows 10/11 ranges listed in EUVD-2026-100427) and network reachability to that DNS service. The CVSS PR:L and the description's 'authorized attacker' wording indicate the attacker must already possess some authorized/authenticated access to the service rather than being a fully anonymous remote actor - this authentication requirement is the primary limiting factor. No user interaction is needed (UI:N), and default configurations running the DNS role are affected once an authorized actor can send requests; impact is limited to information disclosure (no integrity or availability effect).

This is a moderate-severity information-disclosure flaw (CVSS 6.5) whose signals point to a genuine-but-bounded risk rather than a drop-everything emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N confirms network-reachable, low-complexity exploitation, but PR:L means the attacker must already hold some authenticated/authorized access to the DNS Server - consistent with the description's phrase 'authorized attacker,' so the network vector and the authorization requirement are in agreement rather than conflicting. Impact is scoped to confidentiality only (C:H/I:N/A:N): an out-of-bounds read (CWE-125) can leak adjacent process memory but cannot modify data or crash the service by itself. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the absence of these signals is not proof of safety but does argue against imminent mass exploitation. The one meaningful caveat is the privilege prerequisite: whether 'authorized' means an authenticated DNS management role versus any domain user is not clarified by the data and should be verified against the Microsoft advisory, because it materially changes who can reach this. Overall: a real priority for internet- or widely-reachable Windows DNS servers given C:H, but tempered by the authentication requirement and lack of exploitation evidence.

An attacker who already holds authorized access to a Windows DNS Server sends specially crafted DNS queries or requests over the network that trigger an out-of-bounds read, causing the service to return bytes from adjacent memory. Because impact is confidentiality-only, the attacker uses this to leak sensitive process memory (potentially cached records, internal data, or memory that aids further attacks) rather than to alter records or take down the service. No public proof-of-concept was identified in the provided data, so practical exploitation difficulty is unverified.