The flaw is an improper verification of a cryptographic signature within the Windows DNS Server. An attacker who already has authorized local access can use the vulnerability to alter DNS configuration or records. The change can lead to DNS spoofing or other misbehavior that undermines the reliability and integrity of DNS responses served by the affected machine.

Affected products include Microsoft Windows 10 versions 1607 and 1809, and the following Windows Server releases: 2012, 2012 R2, 2016, 2019, 2022, and 2025, each with both standard and Server Core installations.

The CVSS score of 5.5 indicates moderate severity, and the vulnerability does not appear in CISA’s KEV catalog. No EPSS value is published, so the exploitation probability is uncertain. The likelihood of an attack hinges on the attacker already possessing authorized local access; there is no known remote exploitation vector. Consequently, the risk is moderate for environments where local administrators have extensive privileges and DNSSEC is not fully validated.