An out‑of‑bounds read in the Windows DNS client component allows an authorized local attacker to read arbitrary memory contents on the host. The flaw exposes sensitive data that could include credentials, cryptographic material, or other confidential information. The attack requires local execution privileges, and the impact is limited to the system on which the DNS client is running, as it does not allow remote exploitation or privilege escalation.

Affected versions include Microsoft Windows 10 Version 1607 and Version 1809, as well as Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and Server Core editions).

The CVSS score of 5.5 indicates a medium severity vulnerability, while the EPSS score is not available and the issue is not listed in the CISA KEV catalog. The flaw can be exploited by an adversary who already has local access to the target machine and interacts with the DNS client service. No remote attack vector or privilege escalation is required, and the vulnerability does not affect the persistence or integrity of the system beyond leaking information.