The vulnerability is an out‑of‑bounds read in the Windows DHCP Server that can cause the service to crash when triggered by an attacker with authorized local access. The impact is a local denial of service; an attacker cannot gain code execution or compromise confidentiality, but can interrupt DHCP operation for machines on the network. The weakness is identified by CWE‑125 (Out‑of‑Bounds Read) and CWE‑416 (Use After Free).

Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations, are affected. The list includes all x64 editions as indicated by the CPE entries.

The CVSS score of 5.5 reflects a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack requires local privileged actor, suggesting that the risk to remote attackers is low. However, on an affected system, an authorized user could disrupt DHCP service, causing a service outage for all hosts relying on that server.