The vulnerability involves an untrusted pointer dereference within the Windows DNS Server component. By sending crafted DNS traffic, an attacker can trigger this dereference, leading to execution of arbitrary code on the server. This flaw is classified as CWE-822 and results in remote code execution that can compromise the confidentiality, integrity, and availability of the system.

Affected systems include multiple editions of Windows 10 (Versions 1607, 1809, 21H2, 22H2), Windows 11 (Versions 23H2, 24H2, 25H2, 26H2, and 26H1), and Windows Server releases from 2012 to 2025, both standard and Core installations. These products span 32‑bit, 64‑bit, and ARM64 architectures as indicated by the corresponding CPEs.

The CVSS score of 8.8 indicates high severity, and the lack of an EPSS rating does not diminish the risk of exploitation over a network. The vulnerability is not currently listed in the CISA KEV catalogue, but given its high impact and remote nature, the probability of exploitation in the wild is considered significant. The attack vector is network‑based, requiring only the ability to send traffic to the DNS Server port, and if successful, the attacker gains code‑execution privileges on the host.