{"id":"CVE-2026-97006","kind":"vulnerability","aliases":["CVE-2026-97006"],"related":[],"title":"Windows DNS: out-of-bounds read lets an authorized attacker leak memory","description":"Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.","summary":"A memory read past the end of a buffer in Windows DNS lets an attacker who already has authorized access over the network read data from the server's memory. The sources give no more detail on what data is exposed.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-server","infrastructure","windows"],"not_affected_if":["no-windows-dns-server"],"how_to_check":"- Check the Windows Server build with `winver` or `Get-ComputerInfo` and compare it to the patched build in Microsoft's security update guide\n- Confirm whether the DNS Server role is installed with `Get-WindowsFeature DNS`","fix":null,"status":"open","published_at":"2026-11-10T19:22:23+00:00","first_seen_at":"2026-11-10T19:25:34+00:00","triaged_at":"2026-11-10T20:02:41+00:00","updated_at":"2026-11-10T20:02:41+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:02:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DNS: out-of-bounds read lets an authorized attacker leak memory","impact":"low","summary":"A memory read past the end of a buffer in Windows DNS lets an attacker who already has authorized access over the network read data from the server's memory. The sources give no more detail on what data is exposed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","dns-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads leaked server memory over the network","analyst_note":"Find the affected Windows DNS versions and the Microsoft patch in the MSRC entry for CVE-2026-97006; sources given only NVD.","how_to_check":"- Check the Windows Server build with `winver` or `Get-ComputerInfo` and compare it to the patched build in Microsoft's security update guide\n- Confirm whether the DNS Server role is installed with `Get-WindowsFeature DNS`\n- unknown for any further check; the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-windows-dns-server"],"who_is_affected":"Only Windows machines running the DNS Server role can be affected, and the attacker must already have authorized access on the network. The sources do not say which Windows versions or DNS configurations are vulnerable. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":4483,"output_tokens":524,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-97006':16A,19A 'access':44B 'allow':74C 'alreadi':41B 'attack':11A,39B,77C 'author':10A,43B,76C 'bound':6A,69C 'buffer':33B 'cve':14A,17A 'data':49B,63B 'detail':60B 'disclos':79C 'dns':2A,21B,36B,73C 'dns-server':20B 'end':30B 'expos':65B 'give':57B 'inform':80C 'infrastructur':23B 'leak':12A 'let':8A,37B 'memori':13A,26B,54B 'network':47B,83C 'out-of-bound':3A,66C 'past':28B 'read':7A,27B,48B,70C 'server':22B,52B 'sourc':56B 'window':1A,24B,35B,72C","nicknames":[],"mitigations":[],"who_affected":"Only Windows machines running the DNS Server role can be affected, and the attacker must already have authorized access on the network. The sources do not say which Windows versions or DNS configurations are vulnerable. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnsserver","infrastructure","medium","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-97006':16A,19A 'attack':11A 'author':10A 'bound':6A 'cve':14A,17A 'dns':2A 'leak':12A 'let':8A 'memori':13A 'out-of-bound':3A 'read':7A 'window':1A","search_b":"'access':44B 'alreadi':41B 'attack':39B 'author':43B 'buffer':33B 'data':49B,63B 'detail':60B 'dns':21B,36B 'dns-server':20B 'end':30B 'expos':65B 'give':57B 'infrastructur':23B 'let':37B 'memori':26B,54B 'network':47B 'past':28B 'read':27B,48B 'server':22B,52B 'sourc':56B 'window':24B,35B","search_c":"'allow':74C 'attack':77C 'author':76C 'bound':69C 'disclos':79C 'dns':73C 'inform':80C 'network':83C 'out-of-bound':66C 'read':70C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97006","severity":null,"published_at":"2026-11-10T19:22:23+00:00","modified_at":"2026-11-10T19:22:23+00:00","first_seen_at":"2026-11-10T19:25:34+00:00","fetched_at":"2026-11-10T19:25:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}