Windows DNS Server CVE-2026-97840

Exploitation requires the attacker to already hold low-level authorization on or toward the target (CVSS PR:L), so this is not an anonymous internet-wide attack despite the network vector. The vulnerable component is the Windows DNS Server role, meaning only hosts running that role (domain controllers and dedicated DNS servers) are affected - workstations and servers without the DNS role are out of scope. The flaw is an out-of-bounds read reachable over the network with low complexity and no user interaction, yielding memory disclosure only (no integrity or availability impact). Limiting factors: the required authorization level and the need for the DNS Server role to be installed and reachable; Microsoft's description does not name the specific record type or query feature that triggers the read.

This is a moderate-priority vulnerability, not a drop-everything emergency. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity information-disclosure flaw that nonetheless requires some level of authorization (PR:L), which meaningfully caps the exploit population versus a fully unauthenticated bug. The impact profile is confidentiality-only (C:H, I:N, A:N): memory contents can leak, but the attacker cannot modify data or crash the service through this issue alone. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified - per precision rules this is treated as 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description: both agree on a network-facing, authorized-attacker, information-disclosure scenario. Realistic risk is elevated by the product - Windows DNS Server is a widely deployed infrastructure role - but tempered by the authorization requirement and the absence of any evidence of active exploitation. Treat as a standard patch-cycle item, prioritizing internet-facing or multi-tenant DNS servers where low-privilege access is more plausible.

An attacker with low-level authorized access to a Windows DNS Server sends a specially crafted query or request that causes the service to read beyond an allocated buffer (CWE-125), returning adjacent process memory in the response. Because the attack vector is network-based with low complexity (AV:N/AC:L), this can be performed remotely once the attacker holds the required privileges, potentially leaking sensitive in-memory data such as cached records or other process state. No public exploit code was identified in the provided data.