CVE-2026-97844: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

CVE-2026-97844 is a CWE-125 out-of-bounds read vulnerability affecting the DNS Server in multiple versions of Microsoft Windows 10, including Version 1607 and later builds. The flaw permits an authorized attacker to read memory beyond intended bounds, potentially disclosing sensitive information over a network. The vulnerability has been assigned a CVSS 3.1 base score of 6.5, indicating medium severity. Microsoft has published an official fix for this issue, and no known exploits are reported in the wild.

An authorized attacker can exploit this vulnerability to read memory outside the intended buffer in the DNS Server, leading to information disclosure over the network. There is no indication of impact on integrity or availability. The vulnerability does not require user interaction and has low attack complexity but requires privileges (PR:L).

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97844. No additional mitigation steps are indicated by the vendor.