Out-of-bounds read in the Windows DNS Server process allows an attacker with network access to read data beyond intended bounds, leaking potentially sensitive data. This vulnerability is classified as Information Disclosure, with a severity of 6.5 on the CVSS scale. The flaw is a classic memory‑safety error (CWE‑125) that can compromise confidentiality if the disclosed data includes sensitive configuration or cache contents.

All recent Windows client releases and server editions are listed as affected, including Windows 10 variants 1607 through 22H2, Windows 11 branches 23H2 to 26H2, and Windows Server 2012 through 2025. The vulnerability applies to both x86 and x64 architectures, as well as ARM64 for certain Windows 11 builds. No specific sub‑version or build numbers are provided beyond the broad release names.

The CVSS score of 6.5 indicates moderate risk and the lack of an EPSS rating suggests that, at this time, exploitation pressure is unknown. The flaw is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Likely attack vector is a remote attacker who can reach the DNS server process over the network; the attacker requires no local privileges. As with many DNS‑related weaknesses, a compromised DNS instance could provide a foothold for further lateral movement.