An improper enforcement of behavioral workflow in Windows DNS causes service disruption when an attacker sends specially crafted DNS requests, resulting in denial of service and loss of network reachability for clients depending on the compromised domain controller. The vulnerability falls under CWE‑841, indicating a failure to enforce secure operational practices within the DNS daemon.

Affected versions include Windows 10 starting from Version 1607 through Version 1809 as well as all supported Windows Server releases from 2012 to 2025, covering both standard and Server Core installations on 32‑bit and 64‑bit platforms.

The CVSS score of 7.5 categorizes this flaw as high severity. The EPSS score is 1%, indicating a very low exploitation probability. The vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is remote network traffic directed at the DNS service; an attacker can cause the service to crash or become unresponsive by exploiting the workflow enforcement bug. No public exploits have been documented, but because the EPSS score is low, the true likelihood of exploitation remains uncertain.