Windows DNS Server CVE-2026-97843

Exploitation requires the Windows DNS Server role to be installed and reachable, and the attacker must already be an authorized actor (CVSS PR:L) able to send requests to the DNS service - it is NOT unauthenticated. The flaw is an out-of-bounds read in DNS request handling, so a crafted DNS query/request is the trigger; no user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the required privilege level (PR:L) means some pre-existing authorization or access to the DNS service is needed, impact is confined to information disclosure (no integrity or availability effect, C:H/I:N/A:N), and only Windows systems running the DNS Server role below the patched builds listed in EUVD are affected; servers without the DNS role or already patched are not exposed.

This is a moderate, authenticated information-disclosure flaw rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) is internally consistent with the description: 'authorized attacker' aligns with PR:L, and 'disclose information over a network' aligns with AV:N and the confidentiality-only impact (C:H/I:N/A:N). Exploitation requires already holding some privilege on or against the DNS service, which meaningfully lowers real-world risk versus an unauthenticated RCE. There is no EPSS score, no CISA KEV listing, and no evidence of public exploit code in the provided data, so there is currently no public exploit identified at time of analysis and no signal of active exploitation - this contrasts with the high confidentiality impact rating, meaning the theoretical impact (memory disclosure, potentially leaking sensitive process data) is serious but the exploitation likelihood is presently low and unquantified. No SSVC decision data was supplied. Net: a credible patch-in-normal-cycle item for Windows DNS servers, elevated for internet-facing or multi-tenant DNS infrastructure, but not a drop-everything issue absent exploitation evidence.

An attacker with the low-level privileges required to send queries or requests to a vulnerable Windows DNS Server transmits a specially crafted request that triggers an out-of-bounds read (CWE-125) in the DNS service. Because the CVSS vector is AV:N/AC:L/PR:L, this is achievable remotely over the network at low complexity by an authorized actor, and the read returns adjacent process memory to the attacker, disclosing potentially sensitive information. No public proof-of-concept or active exploitation is indicated in the available data.