This vulnerability arises from an incorrect authorization check in the Windows DNS Server component. An attacker who already has authorized access can modify DNS records or other configuration on the local system. The impact is that the attacker can alter DNS responses for the host, potentially redirecting traffic or causing DNS resolution failures. The weakness is an authorization control flaw (CWE‑863). Because the attacker must be authorized, the flaw does not provide remote code execution or privilege escalation beyond the existing user’s privileges.

Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows Server 2012, Microsoft Windows Server 2012 Server Core installation, Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 Server Core installation, Microsoft Windows Server 2016, Microsoft Windows Server 2016 Server Core installation, Microsoft Windows Server 2019, Microsoft Windows Server 2019 Server Core installation, Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 Server Core installation

The CVSS score of 5.5 indicates moderate severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been seen in the wild. Exploitability requires that the attacker already has local or network access to the DNS Server component as an authorized user. Once that is achieved, the attacker can modify DNS entries with no further permission checks. The risk is limited to the integrity of DNS data on the affected host, without exposing higher privileges or remote code execution.