CVE-2026-97840: DNS Server Information Disclosure Flaw

CVE-2026-97840 Overview

CVE-2026-97840 is an out-of-bounds read vulnerability [CWE-125] in Microsoft DNS Server. An authorized attacker can exploit the flaw across a network to disclose sensitive information from process memory. The vulnerability affects the confidentiality of the DNS Server service without impacting integrity or availability. Microsoft documented the issue in the Microsoft Security Update Guide.

Critical Impact
An authenticated network attacker can read memory outside allocated buffers in DNS Server, exposing data that may include query contents, cached records, or adjacent process memory.

Affected Products

Microsoft DNS Server
Windows Server deployments running the DNS Server role
Downstream services relying on the affected DNS Server component

Discovery Timeline

2026-10-13 - CVE CVE-2026-97840 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97840

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft DNS Server. The service reads memory beyond the bounds of an allocated buffer while processing network-reachable input. An attacker with low privileges and network access can trigger the condition and retrieve unintended memory contents in the response path.

The disclosed memory can include fragments of other DNS transactions, cached records, or process metadata. While the flaw does not permit modification of data or disruption of the DNS service, information leakage from a core infrastructure component often supports follow-on attacks. Leaked pointers or session artifacts can accelerate exploitation of adjacent weaknesses.

Root Cause

The root cause is missing or incorrect bounds validation during parsing or serialization of DNS data structures. When the service calculates a read length from attacker-influenced fields without verifying the buffer boundary, it dereferences memory past the end of the intended region. This pattern is characteristic of CWE-125 defects in network protocol parsers.

Attack Vector

Exploitation requires network access to the DNS Server and valid low-level privileges on the system or service. The attacker crafts DNS requests that influence the server to perform an oversized or misaligned read. Successful requests cause the server to return response data containing out-of-bounds memory contents. User interaction is not required, and the attack complexity is low.

No verified public exploit code is available for CVE-2026-97840. Technical specifics are described in the Microsoft Security Update Guide.

Detection Methods for CVE-2026-97840

Indicators of Compromise

Unusual DNS query patterns from authenticated internal clients, especially malformed or oversized record requests.
DNS Server process crashes, memory faults, or anomalous response sizes recorded in Windows Event Logs.
Outbound DNS responses containing non-standard payload sizes relative to the requesting query type.

Detection Strategies

Enable DNS diagnostic and analytical logging on Windows Server to capture full query and response metadata.
Correlate authenticated session activity with DNS query anomalies to identify low-privilege accounts probing the service.
Baseline normal DNS response sizes per record type and alert on statistical deviations.

Monitoring Recommendations

Forward DNS analytical logs and Windows Security events to a centralized SIEM for longitudinal analysis.
Monitor the dns.exe process for crashes, handle leaks, or abnormal memory growth.
Track queries from service accounts and low-privilege users that deviate from expected DNS usage patterns.

How to Mitigate CVE-2026-97840

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected DNS Servers.
Inventory Windows Servers running the DNS Server role and prioritize patching for internet-adjacent or multi-tenant deployments.
Review authentication requirements and remove unnecessary low-privilege accounts that can reach DNS Server interfaces.

Patch Information

Microsoft published remediation details and update packages in the Microsoft Security Update Guide. Administrators should install the vendor-provided update through standard Windows Update, WSUS, or Microsoft Update Catalog channels and validate the patch across all DNS Server instances.

Workarounds

Restrict DNS Server access using network segmentation and firewall rules so only trusted clients and resolvers can reach the service.
Enforce least privilege for accounts able to authenticate to systems hosting the DNS Server role.
Increase logging verbosity on DNS Servers until the patch is deployed to improve the chance of detecting exploitation attempts.

bash

# Example: restrict DNS Server access to trusted subnets via Windows Firewall
New-NetFirewallRule -DisplayName "Restrict DNS Server Inbound" `
  -Direction Inbound -Protocol UDP -LocalPort 53 `
  -RemoteAddress 10.0.0.0/8 -Action Allow

New-NetFirewallRule -DisplayName "Block DNS Server Untrusted" `
  -Direction Inbound -Protocol UDP -LocalPort 53 `
  -Action Block