Windows Server DNS: Out-of-bounds read leads to information disclosure
Summary
An out-of-bounds read in the Windows DNS Server role allows an authorized attacker to disclose information over the network. The attacker needs high privileges, and the impact is limited to confidentiality. Systems that run the DNS Server role on Windows Server 2016, 2019, 2022 or 2025 are affected before the fixed build numbers listed below.
Affected
- Windows Server 2016, including Server Core: before 10.0.14393.9688
- Windows Server 2019, including Server Core: before 10.0.17763.9487
- Windows Server 2022: before 10.0.20348.5870
- Windows Server 2025, including Server Core: before 10.0.26100.33822 (version from a third-party source, not yet confirmed by Microsoft)
- Windows 10, Windows 11 and Windows Server 2012/2012 R2: not listed in the sources reviewed; check MSRC
Fixed in
Install the Microsoft cumulative update that brings the build to the fixed version listed above. Cumulative update names and KB numbers: Unknown.
Workaround
Unknown.
Exploitation
- Microsoft rates exploitation as "Exploitation Less Likely".
- The CVE is not publicly disclosed.
- OffSeq lists it as not known to be exploited.
- No public proof of concept found.
- CISA KEV status and EPSS score: Unknown.
Our recommendation
- Patch affected Windows Server DNS servers in the regular monthly cycle; prioritise domain controllers and any DNS server reachable from the internet.
- Check MSRC for the exact fixed builds and KB numbers before rollout.
- Verify that Windows DNS servers are not reachable from the internet.
- Monitor DNS server logs and restrict administrative access to DNS servers.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Information disclosure – Windows DNS
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131090, KB5131080, KB5131077
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-97006 msrc.microsoft.com
- CVE Record CVE-2026-97006 www.cve.org
- Rapid7: Patch Tuesday review November 2026 www.rapid7.com
- OffSeq Radar: CVE-2026-97006 radar.offseq.com
- Strix AI: CVE-2026-97006 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:17.
Original description (NVD)
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.