A use‑after‑free bug in the Windows DNS service allows an attacker who already has authorized access to the network to execute arbitrary code on the DNS server. The flaw can be exploited over the network through normal DNS traffic, giving the attacker the ability to run code with the privileges of the DNS service, potentially compromising the entire domain controller or other services on the same host. The vulnerability is a classic use‑after‑free (CWE‑416) that, when triggered, can subvert the confidentiality, integrity, and availability of DNS functions on the affected machine.

The affected devices include Windows 10 versions 1607 and 1809, Windows Server 2012 through 2025 including Server Core installations for the 2012, 2012 R2, 2016, 2019, 2022, and 2025 releases. The impact therefore spans a broad range of Windows desktop and server editions deployed in corporate environments.

The CVSS score of 7.5 indicates a moderate to high severity. EPSS data is not available, so exploitation likelihood is currently unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is internal network traffic; an attacker must have some level of network access to the DNS server to exploit the use‑after‑free. Once exploited, the attacker can run code arbitrarily on the DNS service, elevating privileges and potentially pivoting further within the network.