An invalid pointer or reference is released by the Windows DNS Server when processing certain network requests. The flaw leads to uncontrolled execution of arbitrary code on the local machine. Because this vulnerability can be exploited by users with local privileges, an attacker with control over the DNS Server or who can present crafted DNS traffic can gain full system compromise. The weakness is classified as CWE‑763 and corresponds to a severe remote code execution flaw.

The following Microsoft products are vulnerable: Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (duplicate), 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. All affected releases run the built‑in DNS Server service.

With a CVSS score of 8.8 the vulnerability is considered high severity. The EPSS score is not available, indicating that widely available exploit data is currently unknown, but the fact that any authorized network attacker can trigger the flaw means the risk remains significant. The issue is not listed in the CISA KEV catalog. The likely attack vector is over the network through crafted DNS queries sent to an authorized DNS Server instance. Exploit conditions simply require the DNS Server process to be running and the attacker to have the ability to send network traffic to it.