EUVD-2026-100434
GHSA-wc9c-hqxj-2h77
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-level authorized DNS access
-
DeliverySend crafted query to DNS Server
-
ExploitTrigger out-of-bounds read in parser
-
ExecutionReceive leaked adjacent memory
-
ImpactDisclose sensitive information
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Windows DNS Server service plus a low level of authorization (CVSS PR:L; 'authorized attacker' per the description) - it is NOT an unauthenticated remote attack. The target must be running the Windows DNS Server role on an unpatched build (e.g. Windows Server 2016/2019/2022/2025 or Windows 10/11 below the fixed build numbers listed in EUVD-2026-100434). Limiting factors: the required authorization level reduces exposure to purely external anonymous attackers, impact is confined to information disclosure (no write or availability impact), and systems patched to the fixed builds (e.g. Server 2022 ≥10.0.20348.5761, Server 2025 ≥10.0.26100.33650) are not affected. |
| Impact | This is a medium-severity information disclosure flaw (CVSS 6.5) in the Windows DNS Server role, arising from an out-of-bounds read (CWE-125). The CVSS vector AV:N/AC:L/PR:L/UI:N indicates a network-reachable, low-complexity attack that nonetheless requires some level of authorization (PR:L) - the description's phrase 'authorized attacker' independently corroborates this, so this is not an unauthenticated remote bug. Impact is limited to confidentiality (C:H/I:N/A:N): an attacker can disclose memory contents but cannot modify data or cause denial of service, and scope is unchanged (S:U). No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or an available exploit; by the precision rules this is 'no public exploit identified at time of analysis.' The realistic priority is moderate rather than urgent: the privilege requirement and confidentiality-only impact temper the network attack vector. Memory-disclosure OOB reads in DNS can leak pointers or secrets useful for chaining to other bugs, so patch within a normal cycle, prioritizing internet-adjacent or multi-tenant DNS servers. Note the 'Buffer Overflow' tag is imprecise - CWE-125 is an out-of-bounds READ, not an overflow write. |
| Exploit ScenarioDerived | An attacker with low-level authorization sends crafted DNS queries or requests over the network to a vulnerable Windows DNS Server, triggering an out-of-bounds read in the response-handling code. The server returns or reflects adjacent memory contents, leaking potentially sensitive data such as memory-layout pointers or residual buffer contents. No public exploit code is identified at time of analysis, and the low attack complexity means a reliable trigger is plausible once the authorization prerequisite is met. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Information disclosure in the Windows DNS Server role allows a network-positioned attacker holding a low level of authorization (CVSS PR:L, described by Microsoft as an 'authorized attacker') to trigger an out-of-bounds read and leak data from server memory. The issue is rated CVSS 6.5 with confidentiality impact only and no integrity or availability effect, and it affects a wide range of unpatched Windows Server and Windows client builds that enable the DNS Server role, from Windows Server 2012 through Windows Server 2025 plus Windows 10 and Windows 11 releases. No public exploit code has been identified at time of analysis, there is no CISA KEV listing indicating active exploitation, and Microsoft has published a patched update; systems already at the fixed build numbers in the vendor advisory are not affected.
RemediationAI
Vendor-released patch: apply Microsoft's update for CVE-2026-97833 per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97833, which supersedes builds below the fixed revisions published in EUVD-2026-100434 (for example Windows Server 2022 to 10.0.20348.5761 or later, Windows Server 2025 to 10.0.26100.33650 or later, Windows Server 2019 to 10.0.17763.9376 or later, Windows Server 2016 to 10.0.14393.9612 or later, Windows Server 2012 R2 to 6.3.9600.23470 or later, and Windows 11 24H2/25H2 to 10.0.26100.9711 / 10.0.26200.9711 respectively). Because exploitation requires authorization in addition to network reachability, organizations that cannot patch immediately can reduce exposure by restricting who may query the DNS Server service, for example firewall rules limiting UDP/TCP 53 to known internal resolvers, clients, and management subnets and blocking DNS traffic from untrusted segments; the trade-off is that legitimate external or guest clients will lose name resolution unless they are explicitly permitted. Where a host does not need the DNS Server role, removing or disabling that role eliminates the attack surface entirely, and running the DNS service with least privilege and monitoring it for anomalous response behavior provides additional detection depth. No public exploit code was identified at the time of analysis and no CISA KEV entry indicates active exploitation, so prioritization should follow the medium CVSS 6.5 severity and the broad population of unpatched Windows DNS Servers rather than an emergency out-of-band response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an out-of-bounds read (CWE-125) in the DNS Server component of Windows, the implementation that backs the DNS Server role and answers name-resolution queries on UDP/TCP port 53. Out-of-bounds reads of this class typically occur when the service parses a crafted DNS query or response and computes a length or offset incorrectly, causing the process to read memory beyond the intended buffer; the recovered bytes can then be reflected back to the requester as part of a DNS response, turning a memory-safety defect into an information-disclosure primitive. Because the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, exploitation requires network reachability to the DNS service plus some level of authorization - this is explicitly not an unauthenticated remote attack, which limits exposure to attackers who already hold valid credentials or an authorized role on the network. The scope is unchanged, so the defect stays within the DNS Server process, and there is no write or denial-of-service impact; the practical risk is leakage of process memory contents that may include sensitive data handled by the service.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable DNS service with low complexity but requiring low-level authorization (PR:L per 'authorized attacker'); out-of-bounds read yields confidentiality-only impact, so I:N/A:N and S:U.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB