The vulnerability is a type confusion flaw in the Windows DNS Server that allows an attacker with authorized access to execute code over the network. By manipulating data types during resource access, the attacker can control the server's execution flow and run arbitrary code, leading to full compromise of the affected domain controller. The weakness is classified as CWE-822 and CWE-843, indicating improper handling of array indexes and string-to-number conversions.

Microsoft Windows Server 2022, Windows Server 2025, and Windows Server 2025 Server Core installation are affected. The flaw exists in the DNS Server component of these operating systems, and the specific kernel or service components responsible are not enumerated in the provided data. Operators should verify that their domain controllers run one of the listed Windows Server editions.

The CVSS score of 8.8 classifies this flaw as high severity, and the EPSS score is not available, so the exploitation likelihood is uncertain. The flaw is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is a network-based exploitation that requires the attacker to already be authorized to interact with the DNS Server, such as an insider or an attacker who has compromised a client with permission to query DNS. The type confusion vulnerability could allow execution of arbitrary code on the DNS server, leading to full system compromise. Adequate monitoring and rapid patching are therefore critical.