{"id":"CVE-2026-119970","kind":"vulnerability","aliases":["CVE-2026-119970"],"related":[],"title":"Windows DNS: out-of-bounds read lets an authorized user leak memory over network","description":"Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.","summary":"Windows DNS Server has an out-of-bounds read that an authorized attacker can use over the network to disclose information. The sources describe only information disclosure, not code execution.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","self-hosted","windows","windows-dns"],"not_affected_if":["no-windows-dns-server"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:21+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","triaged_at":"2026-11-10T20:02:53+00:00","updated_at":"2026-11-10T20:02:53+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:02:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DNS: out-of-bounds read lets an authorized user leak memory over network","impact":"low","summary":"Windows DNS Server has an out-of-bounds read that an authorized attacker can use over the network to disclose information. The sources describe only information disclosure, not code execution.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-dns","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive server memory over the network","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119970 and Microsoft's advisory for affected Windows Server versions and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-windows-dns-server"],"who_is_affected":"Organizations running Windows DNS Server, where an attacker with some authorization can send requests over the network to read memory they should not see. The sources do not state the affected versions or which configurations are exposed. Sites that do not run Windows DNS Server can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000678,"input_tokens":4483,"output_tokens":460,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119970':18A,21A '-2026':17A,20A 'allow':69C 'attack':43B,72C 'author':10A,42B,71C 'bound':6A,38B,64C 'code':59B 'cve':16A,19A 'describ':54B 'disclos':50B,74C 'disclosur':57B 'dns':2A,29B,31B,68C 'execut':60B 'host':25B 'inform':51B,56B,75C 'infrastructur':22B 'leak':12A 'let':8A 'memori':13A 'network':15A,48B,78C 'out-of-bound':3A,35B,61C 'read':7A,39B,65C 'self':24B 'self-host':23B 'server':32B 'sourc':53B 'use':45B 'user':11A 'window':1A,26B,28B,30B,67C 'windows-dn':27B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Windows DNS Server, where an attacker with some authorization can send requests over the network to read memory they should not see. The sources do not state the affected versions or which configurations are exposed. Sites that do not run Windows DNS Server can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","selfhosted","windows","windowsdns"],"campaign_type":null,"search_a":"'-119970':18A,21A '-2026':17A,20A 'author':10A 'bound':6A 'cve':16A,19A 'dns':2A 'leak':12A 'let':8A 'memori':13A 'network':15A 'out-of-bound':3A 'read':7A 'user':11A 'window':1A","search_b":"'attack':43B 'author':42B 'bound':38B 'code':59B 'describ':54B 'disclos':50B 'disclosur':57B 'dns':29B,31B 'execut':60B 'host':25B 'inform':51B,56B 'infrastructur':22B 'network':48B 'out-of-bound':35B 'read':39B 'self':24B 'self-host':23B 'server':32B 'sourc':53B 'use':45B 'window':26B,28B,30B 'windows-dn':27B","search_c":"'allow':69C 'attack':72C 'author':71C 'bound':64C 'disclos':74C 'dns':68C 'inform':75C 'network':78C 'out-of-bound':61C 'read':65C 'window':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119970","severity":null,"published_at":"2026-11-10T19:20:21+00:00","modified_at":"2026-11-10T19:20:22+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","fetched_at":"2026-11-10T19:25:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}