Windows DNS Server CVE-2026-97829

Exploitation requires the attacker to already hold low-level authorized access (PR:L) reachable to a Windows DNS Server over the network, and targets the DNS Server role specifically - the flaw is not present on Windows systems where the DNS Server role is not installed/enabled. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The key limiting factor is the authentication/authorization prerequisite, which prevents anonymous internet-wide exploitation; the primary consequence is memory disclosure only, with no integrity or availability impact.

This is a moderate-priority vulnerability (CVSS 6.5) rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable exploitation with low attack complexity and no user interaction, but PR:L means the attacker must already hold some level of authenticated/authorized access - a meaningful barrier that excludes anonymous internet-based mass exploitation. Impact is confined to confidentiality (C:H/I:N/A:N): an out-of-bounds read leaks memory contents but does not grant code execution or service disruption. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent: a high-confidentiality but authentication-gated info-disclosure flaw. The main caveat is that the single Microsoft MSRC reference provides no exploitation telemetry, so real-world exploitation likelihood cannot be independently quantified beyond the authentication requirement and the absence of KEV/POC signals.

An attacker who already possesses low-privilege authorized access to a network with a vulnerable Windows DNS Server sends specially crafted DNS queries that trigger an out-of-bounds read in the server's query-parsing logic. The response leaks adjacent process memory, potentially exposing sensitive data such as cached records, internal addresses, or other in-memory secrets. No public exploit code is identified at time of analysis, and the attack requires valid authorized access rather than anonymous network reach.