The vulnerability is a heap‑based buffer overflow in the Windows DNS client that allows an unauthorized attacker to execute arbitrary code on an affected system, as described in the CVE text. The flaw is triggered by the DNS client when it processes network traffic and grants the attacker remote code execution capabilities. This flaw is aligned with CWE‑122, which identifies unsafe memory handling that can lead to arbitrary code execution.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1, 22H3, and 26H1, as well as Microsoft Windows Server 2022 (Server Core installation) and Microsoft Windows Server 2025 (including Server Core installation) are affected. The list is drawn from the provided CNA vendor/product names and the CPE strings enumerated in the CVE data.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score is not available, suggesting current exploit data is limited. The flaw can be triggered over the network by sending a crafted DNS request to the client, which implies that any device with the vulnerable DNS client exposed to external traffic is at risk. The product is not currently listed in the CISA KEV catalog, reducing the likelihood of known mass exploitation but not eliminating it.