The vulnerability arises from a type‑confusion flaw in the DNS Server, allowing an unauthorized attacker to access resources using an incompatible type and execute code over a network. This flaw enables attackers to run arbitrary code with the privileges of the DNS service, potentially compromising the entire operating system, extracting credentials, or installing malware. The weakness is identified as CWE-843, which denotes type confusion in memory management.

Affected Windows products span numerous generations, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 on ARM64, and 26H1; as well as Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both full and Server Core configurations. Each listed version may host the vulnerable DNS server component.

The CVSS score of 8.8 classifies this as high severity, indicating significant impact if exploited. The EPSS score is not available, so current likelihood of exploitation is unknown, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector involves traffic to the DNS Server over the network; an attacker can craft a malicious request that exploits the type‑confusion behavior to trigger arbitrary code execution. Behind trusted infrastructure, such an attack could compromise domain controllers and any services depending on DNS resolution.