Windows DNS Server CVE-2026-97828

Exploitation targets the Windows DNS Server role on affected Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025) and Windows 10/11 builds and requires the DNS Server service to be reachable over the network. Per CVSS PR:L, the attacker must hold a low level of authorization to the service rather than being fully anonymous ('authorized attacker') - the precise authorization context (e.g., an authenticated DNS management or zone-update path) is not spelled out in the description and should be confirmed with Microsoft. Limiting factors: authentication/authorization is required (not default-anonymous DNS query access per the stated vector), impact is confined to information disclosure (no integrity or availability effect), and patched builds listed in EUVD remediate the issue.

This is a moderate-severity information disclosure flaw rather than a top-tier priority. The CVSS 3.1 score of 6.5 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects network-reachable, low-complexity exploitation but with a meaningful authentication gate (PR:L) and impact limited to confidentiality (C:H, with I:N/A:N) - consistent with a CWE-126 buffer over-read that leaks adjacent process memory. Exploitation status is 'no public exploit identified at time of analysis': the input provides no CISA KEV listing, no POC flag, and no EPSS probability, so there is no signal of active or widespread exploitation. One point worth verifying with the vendor: Microsoft's DNS Server service normally answers unauthenticated network queries, yet the vector asserts PR:L ('authorized attacker'); this suggests the vulnerable code path requires some pre-existing privilege (e.g., an authenticated management interface or a privileged DNS client/zone-update context) rather than an anonymous DNS query - confirm the exact authorization context via MSRC before deprioritizing based on the auth requirement. Overall: real but not urgent - patch in normal cycle, prioritizing internet-exposed DNS servers.

An attacker with the required low-level authorization to the Windows DNS Server service sends a specially crafted request that triggers an out-of-bounds read in a DNS message/record parser, causing the server to return bytes from adjacent memory. No public exploit code is identified at the time of analysis, and the flaw yields only information disclosure (no code execution or service impact per CVSS I:N/A:N).