CVE-2026-97843: DNS Server Information Disclosure Flaw

CVE-2026-97843 Overview

CVE-2026-97843 is an out-of-bounds read vulnerability [CWE-125] in Microsoft DNS Server. An authorized attacker can read memory beyond the intended buffer boundary and disclose sensitive information over a network. The flaw affects confidentiality but does not permit modification or disruption of DNS Server operations.

Microsoft published the advisory on October 13, 2026. Exploitation requires low-level privileges on the network path, no user interaction, and low attack complexity. No public proof-of-concept code or in-the-wild exploitation has been reported at this time.

Critical Impact
An authenticated remote attacker can trigger an out-of-bounds read in Microsoft DNS Server to disclose memory contents, potentially exposing cached records, internal network data, or process memory fragments.

Affected Products

Microsoft DNS Server (see Microsoft Security Update Guide for the full list of affected Windows Server builds)
Windows Server installations running the DNS Server role
Environments where DNS Server is reachable by authenticated network users

Discovery Timeline

2026-10-13 - CVE-2026-97843 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97843

Vulnerability Analysis

The vulnerability resides in how Microsoft DNS Server parses or processes DNS protocol structures. When handling a specially crafted request, the service reads data past the end of an allocated buffer. The out-of-bounds data is then returned or reflected back to the requester, enabling information disclosure.

The scope is unchanged, meaning the read is confined to the DNS Server process address space. However, DNS Server memory frequently contains cached resource records, zone data, and transient query state. Disclosure of this memory can expose internal hostnames, IP mappings, and other data useful for lateral movement.

The EPSS probability indicates a modest likelihood of exploitation development within 30 days. The absence of a published proof-of-concept does not eliminate the risk, since DNS Server vulnerabilities are frequent targets for internal reconnaissance.

Root Cause

The root cause is a missing or insufficient boundary check during DNS message parsing. The code reads beyond the end of a buffer when processing a field whose length is not validated against the actual buffer size. This matches the CWE-125 pattern of out-of-bounds read conditions in protocol handlers.

Attack Vector

The attacker must authenticate on the network to reach the DNS Server endpoint. The attacker then sends a crafted DNS query or related protocol message designed to trigger the out-of-bounds read. The server responds with data that includes memory fragments beyond the intended buffer. No user interaction and no elevated privileges are required.

Technical details on the specific DNS message type and parsing path are not publicly disclosed. Consult the Microsoft Security Update Guide for additional technical context.

Detection Methods for CVE-2026-97843

Indicators of Compromise

Unusual volumes of DNS queries from a single authenticated source targeting the DNS Server role
DNS responses containing unexpected binary data, oversized answer sections, or malformed resource records
DNS Server process memory anomalies, crashes, or restarts coinciding with crafted query traffic
Outbound exfiltration of DNS response payloads to internal reconnaissance tools

Detection Strategies

Enable DNS analytical and audit logging on Windows Server and forward events to a central SIEM for query pattern analysis
Baseline normal DNS query types and flag anomalous record types or malformed queries from authenticated hosts
Correlate DNS Server event logs with endpoint telemetry to identify internal hosts probing the DNS role

Monitoring Recommendations

Monitor the DNS Server service for unexpected restarts, access violations, or memory faults in the Application and System event logs
Alert on authenticated users issuing high rates of nonstandard DNS record queries such as unusual OPT, TKEY, or TSIG messages
Track network flows to UDP and TCP port 53 from internal subnets that do not normally initiate direct DNS traffic to authoritative servers

How to Mitigate CVE-2026-97843

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Windows Servers running the DNS Server role
Inventory all internal DNS Servers and prioritize patching those exposed to untrusted or broad authenticated populations
Review DNS Server access controls and restrict query sources to required network segments

Patch Information

Microsoft has released a security update addressing CVE-2026-97843. Administrators should review the Microsoft Security Update Guide for the specific KB article, affected build numbers, and installation guidance for each supported Windows Server version.

Workarounds

Restrict DNS Server exposure using Windows Firewall or network ACLs to limit which authenticated hosts can reach port 53
Segment the DNS Server role onto dedicated infrastructure separated from general-purpose authenticated services
Disable unused DNS features such as recursion on authoritative servers where not required

bash

# Example: Restrict inbound DNS traffic to approved subnets using Windows Firewall
New-NetFirewallRule -DisplayName "Restrict DNS to Trusted Subnets" `
  -Direction Inbound -Protocol UDP -LocalPort 53 `
  -RemoteAddress 10.0.0.0/8,192.168.0.0/16 -Action Allow

New-NetFirewallRule -DisplayName "Block DNS from Untrusted Sources" `
  -Direction Inbound -Protocol UDP -LocalPort 53 `
  -Action Block