A use‑after‑free flaw in the Windows DNS Server process allows an unauthorized network attacker to execute arbitrary code. The vulnerability is triggered when a specially crafted DNS request causes the server to use a freed memory buffer, providing an attacker with the privileges of the DNS service. Successful exploitation would grant full compromise of the affected host, jeopardizing confidentiality, integrity, and availability of the system.

Affected systems include Microsoft Windows 10 version 1607 and 1809, as well as Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both standard and Server Core installations.

The CVSS score of 9.8 places this flaw in the critical severity range. The EPSS score is 1%, indicating a low but non-zero likelihood of exploitation; however, the remote code execution nature implies a high risk if the vulnerability is publicly known. The flaw is not listed in the CISA KEV catalog. Attackers would need network access to the DNS server to craft the malicious request, and because the DNS service runs with SYSTEM privileges, successful exploitation yields full system control.