CVE-2026-97842: DNS Server Information Disclosure Flaw

CVE-2026-97842 Overview

CVE-2026-97842 is an out-of-bounds read vulnerability in Microsoft DNS Server. An authorized attacker can exploit this flaw over a network to disclose sensitive information from the DNS Server process memory. The weakness is classified under CWE-125, which covers reads beyond the bounds of an allocated buffer.

The vulnerability requires low-privilege authenticated access and no user interaction. Exploitation targets confidentiality only; integrity and availability of the DNS Server remain unaffected. Successful exploitation can expose process memory contents, which may include DNS record data, cached query information, or other service state.

Critical Impact
Authenticated network attackers can read uninitialized or adjacent memory from the DNS Server process, exposing sensitive runtime data.

Affected Products

Microsoft DNS Server (see Microsoft CVE-2026-97842 Advisory for specific build numbers)
Windows Server deployments running the DNS Server role
Environments with authenticated users able to issue DNS Server requests

Discovery Timeline

2026-10-13 - CVE-2026-97842 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97842

Vulnerability Analysis

The vulnerability resides in the Microsoft DNS Server component and stems from an out-of-bounds read condition. When processing specific DNS-related input, the server reads memory beyond the intended buffer boundary. The resulting data is returned or exposed to the requesting client, leading to information disclosure.

The flaw requires network access and valid low-level credentials. Attack complexity is low, and no user interaction is required. The impact is limited to confidentiality: an attacker can learn the contents of memory regions adjacent to the vulnerable buffer, but cannot modify data or crash the service through this specific flaw.

According to Exploit Prediction Scoring System (EPSS) data from 2026-10-14, the probability of exploitation in the near term remains low. No public proof-of-concept code or exploitation in the wild has been reported at the time of publication.

Root Cause

The root cause is improper validation of input length or boundary conditions when the DNS Server parses network-supplied data. The parser dereferences memory using an index or pointer that exceeds the allocated buffer. This behavior aligns with CWE-125: Out-of-bounds Read.

Attack Vector

An authenticated attacker sends crafted DNS requests to a vulnerable DNS Server across the network. The malformed request triggers the parsing routine into reading past buffer limits. The server returns or logs the out-of-bounds data in a manner observable by the attacker. Refer to the Microsoft CVE-2026-97842 Advisory for protocol-level specifics.

No verified exploitation code is publicly available. Technical details beyond the Microsoft advisory have not been released.

Detection Methods for CVE-2026-97842

Indicators of Compromise

Anomalous DNS queries from authenticated internal accounts targeting the DNS Server role
Unexpected response sizes or malformed response payloads returned by the DNS Server
Repeated DNS requests with unusual record types or oversized query fields originating from a single authenticated source

Detection Strategies

Enable DNS analytical and audit logging on Windows DNS Servers to capture query patterns and client identifiers
Correlate authenticated session activity with DNS query volume to identify reconnaissance patterns
Alert on DNS traffic that deviates from baseline query structure, such as abnormal opcode or record-type distributions

Monitoring Recommendations

Forward DNS Server event logs and ETW traces to a centralized SIEM for retention and correlation
Monitor for process memory anomalies in dns.exe using endpoint telemetry
Track authenticated user accounts generating DNS query volumes outside historical norms

How to Mitigate CVE-2026-97842

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-97842 Advisory to all affected DNS Server instances
Inventory all Windows Servers running the DNS Server role and prioritize internet-reachable or multi-tenant systems
Review authenticated access to DNS Servers and remove unnecessary accounts that can issue direct queries

Patch Information

Microsoft has released a security update addressing CVE-2026-97842. Administrators should consult the Microsoft CVE-2026-97842 Advisory for the applicable Knowledge Base article and build numbers for each supported Windows Server version. Deploy the patch through Windows Update, Windows Server Update Services (WSUS), or your preferred patch management workflow.

Workarounds

Restrict DNS Server access to trusted network segments using host-based and network firewalls
Enforce least-privilege authentication so only required service accounts can submit DNS requests
Increase monitoring and log retention on DNS Servers until patches are deployed across the environment

bash

# Verify DNS Server patch status on Windows Server
Get-HotFix | Where-Object { $_.Description -eq "Security Update" } | Sort-Object InstalledOn -Descending

# Confirm DNS Server service version
Get-WmiObject Win32_Service -Filter "Name='DNS'" | Select-Object Name, PathName
(Get-Item (Get-WmiObject Win32_Service -Filter "Name='DNS'").PathName.Trim('"')).VersionInfo