Windows DNS Server CVE-2026-97844

Exploitation requires the target host to be running the Windows DNS Server role (typically domain controllers or dedicated DNS servers, not standard workstations) and the attacker to possess low-level authorization, as indicated by CVSS PR:L - this is not an unauthenticated flaw. The attacker then sends crafted DNS requests over the network (AV:N/AC:L/UI:N) to trigger the out-of-bounds read. Limiting factors: the required authorization/authentication and the need for the DNS Server role to be enabled and network-reachable constrain the exposed population; impact is read-only confidentiality disclosure with no integrity or availability effect.

This is a moderate-severity information disclosure flaw (CVSS 6.5) rather than a critical, must-patch-immediately issue. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the attack is remotely reachable with low complexity and no user interaction, but it requires some level of authorization (PR:L), which meaningfully raises the bar versus a fully unauthenticated flaw. Impact is confined to confidentiality (C:H/I:N/A:N) - an attacker can read out-of-bounds memory from the DNS Server process but cannot modify data or cause a denial of service through this vector alone. No EPSS score, SSVC decision data, KEV listing, or public POC is present in the provided intelligence, so there is no signal of active exploitation or automatable mass-exploitation; the real-world urgency currently appears low-to-moderate and should be driven by exposure of the DNS Server role rather than by exploitation telemetry. Note the tag 'Buffer Overflow' is somewhat imprecise for a CWE-125 out-of-bounds read (a memory read, not an overflow write), and the EPSS/KEV/POC signals are simply absent rather than confirmed negative - verify exploitation status against vendor and CISA sources before deprioritizing.

An attacker who already holds low-privilege authorized access reachable to the Windows DNS Server sends a specially crafted DNS request that triggers an out-of-bounds read in the server's parsing logic, causing it to return adjacent process memory. The leaked memory could expose sensitive data such as cached records, configuration details, or memory fragments useful for chaining further attacks. No public exploit code or active exploitation was identified in the provided data at the time of analysis.