A heap-based buffer overflow in the Windows DNS client allows an unauthorized attacker to execute arbitrary code on an affected system. The flaw arises from unsafe memory handling during DNS request processing and is mapped to CWE-122. It can lead to full compromise of the system, and based on the description it is inferred that no user interaction is required from the victim, but this inference is not explicitly stated in the source.

Windows 11 versions 23H2, 24H2, 25H2, and 26H1, as well as Windows Server 2022 23H2 Edition (Server Core) and Windows Server 2025 (including Server Core), are identified as affected by this issue.

The CVSS score of 9.8 indicates critical severity, and the EPSS score of 2% reflects a low but non-zero chance of exploitation. An attacker can trigger the overflow over the network by sending a crafted DNS request to the client, meaning any device with the vulnerable DNS client exposed to external traffic is at risk. The product is not listed in the CISA KEV catalog, suggesting that no known large‑scale exploitation has occurred yet, but this does not prevent future attacks.