EUVD-2026-100433
GHSA-pqg7-f88g-5xr8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authorized network access
-
DeliverySend crafted DNS query to DNS Server
-
ExploitTrigger out-of-bounds read in query parser
-
ExecutionLeak adjacent memory in response
-
ImpactDisclose sensitive information
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Target must be a Windows host with the DNS Server role installed and reachable over the network. The attacker must hold low-level authorization (CVSS PR:L) - exploitation is not possible by a fully anonymous/unauthenticated actor. No user interaction is required (UI:N). The flaw affects numerous Windows and Windows Server builds below the patched versions listed in EUVD (e.g., Server 2016/2019/2022/2025 and Windows 10/11 branches); systems not running the DNS Server role or already patched to the fixed build (e.g., Server 2025 ≥10.0.26100.33650) are not exposed. The principal limiting factors are the required authorization level and the need for the DNS Server role to be active. |
| Impact | This is a moderate-severity information-disclosure flaw (CVSS 6.5) rather than a top-tier emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates a network-reachable, low-complexity attack but one that requires some level of privilege (PR:L), meaning the attacker must be authorized/authenticated rather than fully anonymous. Impact is confined to confidentiality (C:H) with no integrity or availability effect, consistent with an out-of-bounds read (CWE-125) that leaks memory contents. No EPSS score, no CISA KEV listing, and no public exploit were supplied in the input, so there is no evidence of active exploitation or weaponization - exploitation status is 'no public exploit identified at time of analysis.' The PR:L requirement is the key risk-limiting factor: it downgrades this from a wormable, unauthenticated DNS catastrophe to a flaw an already-authorized actor could abuse to disclose server memory. Note a minor tension between the description's phrase 'authorized attacker' and the moderate privilege level; the CVSS PR:L confirms authentication is required, so treat this as an authenticated information-disclosure issue. A patch is available from the vendor, so the primary action is to apply the October 2026 Windows updates to DNS Server hosts. |
| Exploit ScenarioDerived | An attacker with low-level authorized access on the network sends specially crafted DNS queries to a Windows Server running the DNS Server role, triggering an out-of-bounds read that returns adjacent process memory in responses. Over repeated requests the attacker harvests fragments of server memory that may contain sensitive data. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Information disclosure in the Windows DNS Server role lets an authenticated, low-privileged attacker read past the bounds of an allocated buffer and leak memory contents over the network. The flaw (CWE-125, out-of-bounds read) affects a broad set of Windows Server builds - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and only exposed systems that have the DNS Server role installed and reachable. Impact is limited to confidentiality (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect; no public exploit has been identified at time of analysis, and vendor-released patches are available per the Microsoft advisory.
RemediationAI
Apply the Microsoft vendor patch; fixed builds are available through the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97832 and should be installed on every affected platform that runs the DNS Server role - Windows Server 2012 ≥ 6.2.9200.26434, Server 2012 R2 ≥ 6.3.9600.23470, Server 2016 and Windows 10 1607 ≥ 10.0.14393.9612, Server 2019 and Windows 10 1809 ≥ 10.0.17763.9376, Windows 10 21H2/22H2 ≥ 10.0.19044.7807, Server 2022 ≥ 10.0.20348.5761, Server 2025 ≥ 10.0.26100.33650, Windows 11 23H2 ≥ 10.0.22631.7652, Windows 11 24H2 ≥ 10.0.26100.9711, Windows 11 25H2 ≥ 10.0.26200.9711, Windows 11 26H1 ≥ 10.0.28000.3231 and Windows 11 26H2 ≥ 10.0.26300.9711. Because exploitation needs only low-level authorization against a reachable DNS server and no user interaction, prioritize internet-facing or broadly exposed DNS servers, and as a compensating control until patching completes, restrict who can reach port 53 (firewall the service to trusted client subnets and block inbound DNS from untrusted networks), which reduces the eligible attacker set but can break legitimate recursive or external resolution paths; do not expose the DNS Server role on hosts that do not need it, and where the role is required but not externally necessary, disabling recursion and forwarding to a hardened resolver narrows the attack surface at the cost of additional resolver configuration. No public exploit has been identified at time of analysis, so these controls are precautionary hardening rather than emergency response, but the broad affected build list makes a timely update cycle advisable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-125 out-of-bounds read in the Microsoft Windows DNS Server service (dns.exe), the component that implements the DNS protocol and answers queries on UDP/TCP port 53. Underlying the issue is unsafe parsing of DNS message data - the affected builds fail to validate that a read stays within the bounds of the allocated buffer, so crafted DNS traffic causes the service to read adjacent memory and return or expose its contents across the network. Intelligence tags classify this both as a buffer overflow condition and as information disclosure, which is consistent with the assessed CVSS vector: scope unchanged (S:U), high confidentiality impact (C:H), and no integrity or availability impact (I:N/A:N). The CVSS vector PR:L indicates exploitation requires a low-privileged, authorized position rather than fully anonymous access, and UI:N means no user interaction is needed once the attacker can reach the DNS service. EUVD lists the exact affected build ranges, and the compensating factor across all variants is that the DNS Server role must be installed and network-reachable; hosts without that role, or hosts already updated to the fixed build, are not exposed.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-facing DNS service (AV:N) with low complexity; 'authorized attacker' and vendor PR:L confirm required privileges; out-of-bounds read yields confidentiality loss only (C:H, I:N, A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB