Windows DNS Server CVE-2026-97841

The target must be a Windows host with the DNS Server role installed and reachable over the network; the flaw is in that role's request-parsing path, so hosts without the DNS Server role are not affected. Exploitation requires the attacker to hold low-level authorization (PR:L), not fully unauthenticated access, and the attacker must be able to deliver crafted DNS traffic to the server. Limiting factors: the authorization prerequisite narrows the attacker set, impact is confined to information disclosure (no integrity or availability effect), and only the affected build ranges listed in EUVD prior to the patched versions are vulnerable.

This is a moderate-severity information-disclosure flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) in the Windows DNS Server role. The signals are internally consistent and point to real but bounded risk: the network attack vector (AV:N) and low attack complexity (AC:L) make the flaw reachable remotely, but PR:L means the attacker must already hold some authorization on the target, which narrows the realistic attacker population and argues against mass, unauthenticated exploitation. Impact is confined to confidentiality (C:H, with I:N/A:N), consistent with a CWE-125 out-of-bounds read that leaks memory contents rather than enabling code execution or service disruption. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no evidence of active exploitation - exploitation status is 'no public exploit identified at time of analysis.' Net assessment: a legitimate patch-management priority for Internet-facing or multi-tenant DNS servers because of the network vector and high confidentiality impact, but not an emergency relative to a wormable or unauthenticated RCE. No key signals conflict; the main gap is the absence of EPSS/KEV/POC data, which prevents refining the real-world exploitation likelihood.

An attacker who already holds low-level authorization sends crafted queries or requests to a Windows DNS Server over the network, triggering an out-of-bounds read in the DNS parsing path. The server returns or exposes adjacent memory contents, potentially leaking sensitive data such as credentials, cryptographic material, or other process memory. No public exploit code was identified in the provided data, so exploitation currently requires original development.