The vulnerability resides in the Windows DNS Server component, where an incorrectly enforced authorization check allows an attacker who already has local authorized rights to bypass a built‑in security feature. This flaw is a CWE‑863 local authorization bypass vulnerability, meaning that a legitimate local user can configure DNS beyond the intended permissions. The result may disrupt DNS resolution, cause mis‑configurations, and expose the system to further compromise. The impact is limited to the local machine and does not provide privilege escalation beyond the existing authorized context.

Microsoft Windows 10 versions 1607 and 1809, and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, are impacted.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% shows a very low probability of being exploited in the wild. This vulnerability is not listed in the CISA KEV catalog. The attack vector is local, requiring the attacker to have authorized access to the affected machine; no outward network access or elevated privileges are needed to exploit the flaw.