Windows DNS Server CVE-2026-97836

Exploitation requires the target to be running the Windows DNS Server role (not present on default Windows clients/servers unless the DNS Server feature is installed, typically on Active Directory domain controllers and DNS infrastructure hosts). The CVSS PR:L metric means the attacker must hold at least low-level privileges or the ability to authenticate/interact with the DNS service - it is not an anonymous unauthenticated attack. No user interaction is required (UI:N) and no special non-default DNS configuration is named in the description beyond the role itself being enabled. The limiting factors are the privilege requirement and the need for the DNS Server role to be deployed and network-reachable; impact is limited to information disclosure with no integrity or availability effect.

This is a medium-severity information disclosure flaw (CVSS 6.5) in the Windows DNS Server role, with a CVSS vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The signals are internally consistent and point to a moderate, not critical, priority: network-reachable (AV:N) and low attack complexity (AC:L), but it requires some level of privilege (PR:L), meaning it is authenticated rather than freely remote-unauthenticated. Impact is confined to confidentiality (C:H) with no integrity or availability effect, consistent with an out-of-bounds read (CWE-125) that leaks memory rather than enabling code execution. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this tempers the real-world urgency relative to the broad Windows footprint. The main contrast to note: the PR:L requirement materially limits exploitation to attackers who can already authenticate or otherwise interact with the DNS service with some privilege, which argues against mass, opportunistic exploitation despite the ubiquitous platform. Absent EPSS/KEV/POC data, exploitation likelihood cannot be quantified and should be treated as unknown rather than low.

An authenticated attacker with low-level privileges sends a crafted DNS query or request over the network to a vulnerable Windows DNS Server, triggering an out-of-bounds read in the DNS parsing code. The server returns or exposes adjacent process memory, potentially leaking sensitive data such as cached records or in-memory secrets. No public proof-of-concept was identified in the provided data.