Windows DNS Server CVE-2026-97834

Requires a running Windows DNS Server role (typically on domain controllers or dedicated DNS servers) reachable over the network, and the attacker must hold at least low-level valid privileges (CVSS PR:L; description specifies an 'authorized attacker') - it is NOT exploitable by fully unauthenticated attackers. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the privilege prerequisite narrows the attacker population, and impact is restricted to information disclosure (C:H, I:N, A:N) with no code execution or denial of service; exposure depends on the DNS Server role actually being enabled on the host.

This is a medium-severity (CVSS 6.5) out-of-bounds read information-disclosure flaw in the Windows DNS Server role. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network reach, low complexity, and no user interaction, but crucially requires some level of privilege (PR:L) - consistent with the description's 'authorized attacker.' Impact is confined to confidentiality (C:H) with no integrity or availability effect, meaning this leaks memory contents (potentially sensitive DNS data, tokens, or adjacent heap/stack information) rather than enabling code execution or service disruption. No EPSS score, KEV listing, or POC indicator is present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic priority is moderate: the authentication requirement meaningfully lowers mass-exploitation potential, but because Windows DNS Server is commonly co-located on Active Directory domain controllers, any confidentiality leak in that context is sensitive. Note a mild framing tension - the CVSS network vector plus the 'authorized attacker' wording means an attacker must already hold valid low privileges before reaching the network-exposed DNS surface; verify the exact privilege prerequisite against the Microsoft advisory.

An attacker holding low-level authenticated access within the environment sends specially crafted DNS queries or records to a vulnerable Windows DNS Server over the network, triggering an out-of-bounds read in the parsing path (AV:N/AC:L/PR:L/UI:N). The server returns or exposes adjacent process memory, disclosing sensitive information to the attacker. No public proof-of-concept is identified in the available data.