Use after free in the Windows DNS server allows an authorized attacker to execute arbitrary code within the DNS service’s context. The flaw occurs when the server accesses memory that has already been freed; a carefully crafted DNS request can manipulate the execution path and trigger code execution. An attacker who can send such requests from a trusted network location—such as a compromised workstation or a privileged user—can gain control of the DNS server process.

The vulnerability affects Microsoft Windows 10 (Version 1607 and 1809) and a broad set of Windows Server releases from 2012 through 2025, including Server Core installations. All affected instances run the DNS Server service on the listed operating systems.

The CVSS score of 8.8 indicates a high severity risk. Although the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the potential for exploitation remains significant in environments where the DNS server is exposed to trusted internal networks. An attacker with network-level access can craft malicious DNS packets to trigger the use‑after‑free, leading to remote code execution with the privileges of the DNS service, which commonly operates under elevated system accounts.