DNS client in Microsoft Windows 8.1; Windows Server 2012 R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016…

Description

DNS client in Microsoft Windows 8.1; Windows Server 2012 R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 fails to properly process DNS queries, which allows remote attackers to obtain sensitive information via (1) convincing a workstation user to visit an untrusted webpage or (2) tricking a server into sending a DNS query to a malicious DNS server, aka "Windows DNS Query Information Disclosure Vulnerability."

Scores

EPSS (exploitation in 30 days)

14.0% · top 3.4% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• Information Disclosure
• CWE-200 (opens in a new tab)All about CWE-200 and its CVEs

Affected products

• Microsoft Corporation · Windows dnsclient

  • affected Windows DNS client in Microsoft Windows 8.1; Windows Server 2012 R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016

References (3)

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0057 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 96695 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 1038001 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2017-0057](https://trackcve.app/badge/CVE-2017-0057.svg)](https://trackcve.app/cve/CVE-2017-0057)

Record last updated 5 Aug 2024, 12:55 UTC.