Windows DNS Server CVE-2026-97827

Exploitation requires the attacker to already possess low-level authentication/privilege (CVSS PR:L) and network reachability to the Windows DNS Server service - it is not exploitable by a fully unauthenticated remote attacker. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific DNS feature, record type, or query that triggers the out-of-bounds read is not disclosed in the available description, so defenders cannot yet pin exploitation to a particular configuration. Limiting factors: the requirement for prior authentication/privilege, the confidentiality-only impact (no code execution or denial of service), and the need to reach a host actually running the DNS Server role rather than every Windows system.

This is a moderate-priority, authenticated information-disclosure flaw rather than a critical pre-auth RCE. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates network reachability with low attack complexity and no user interaction, but crucially requires PR:L - the attacker must already hold some privilege/authentication, which materially lowers real-world risk versus an unauthenticated DNS flaw. Impact is confidentiality-only (C:H/I:N/A:N): an out-of-bounds read (CWE-125) can leak adjacent process memory but cannot modify data or crash the service, so there is no integrity or availability consequence. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The primary risk driver is prevalence: Windows DNS Server is a core role in most Active Directory environments, so a widely-present confidentiality leak is worth patching promptly even though it is not a drop-everything emergency. No conflicting signals were detected between the CVSS vector and the description - both describe authenticated, network-based information disclosure.

An attacker who already holds low-level authenticated access reachable to a Windows DNS Server sends crafted DNS queries or requests that trigger an out-of-bounds read in the server's parsing logic, causing it to return bytes from adjacent memory. The leaked memory could contain sensitive internal data (e.g., cached records, pointers, or other process state) useful for further attacks. No public proof-of-concept was provided in the intelligence data.