Windows DNS Server CVE-2026-97835

Exploitation requires the Windows DNS Server role to be installed, running, and reachable over the network (typically a domain controller or dedicated DNS host in an Active Directory environment), and the attacker must hold low-privilege authenticated access (PR:L) to the environment - it is not exploitable by fully anonymous remote attackers. The primary limiting factors are the authentication requirement and the fact that only hosts with the DNS Server role enabled are affected, not every Windows installation; impact is limited to information disclosure (C:H only) with no code execution, data tampering, or service disruption.

This is a moderate-severity information-disclosure flaw (CVSS 6.5) in Microsoft's Windows DNS Server, driven entirely by a confidentiality impact (C:H/I:N/A:N) with no integrity or availability consequence. The CVSS vector indicates a network-reachable attack (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but crucially requires low-level privileges (PR:L) - so this is NOT an unauthenticated internet-facing exploit, which meaningfully constrains the attacker population to those with existing authenticated access. No EPSS score, KEV listing, or public POC is provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the signals are therefore consistent and non-conflicting, all pointing to a real-but-not-urgent issue. No SSVC decision data was supplied. Net assessment: a genuine out-of-bounds read (CWE-125) worth patching in DNS infrastructure, but it sits below the priority of a wormable or unauthenticated RCE - an authenticated attacker leaking memory contents is the realistic ceiling, not system takeover.

An attacker who already holds low-privilege authenticated access sends specially crafted DNS queries or records to a Windows DNS Server, triggering an out-of-bounds read that returns adjacent process memory in the response. This could leak sensitive in-memory data such as cached records, pointers, or fragments usable to defeat memory-layout defenses. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means a working exploit, if developed, would be reliable.