The vulnerability originates from an out-of-bounds read in the Windows DHCP Server component. An attacker can send crafted DHCP packets to the server, causing the process to read memory beyond intended boundaries. This results in unauthorized disclosure of data that resides in server memory. Based on the description, it is inferred that the attacker may gain access to configuration data, credentials, or other private information. This is a typical example of a CWE‑125 flaw, where insufficient bounds checking allows memory disclosure.

Microsoft Windows products susceptible to this issue include Windows 10 versions 1607 and 1809, as well as Windows Server 2012 through 2025, including their Server Core variants. The flaw specifically targets the DHCP Server component installed on these operating systems, and all versions listed by the CNA are affected unless a later patch removes the vulnerability.

The vulnerability has a CVSS score of 5.9, which corresponds to moderate risk. The EPSS score is not reported, and it is not currently listed in CISA's KEV catalog, indicating no known public exploitation. The flaw can be triggered remotely from a host that can reach the DHCP Server's listening port. Based on the description, it is inferred that the attacker may send specially crafted DHCP packets to the server from the same local network, exploiting the out-of-bounds read. Because the bug allows arbitrary memory disclosure, it poses a significant threat to confidentiality.