This vulnerability is a pointer dereference flaw in the DNS Server that allows an attacker to execute arbitrary code when a specially crafted DNS query is processed. The flaw arises from an untrusted pointer dereference that can be triggered remotely, leading to memory corruption that can be leveraged to run malicious code. As a result, the impact is full remote code execution with no authentication or privilege requirement.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations. The flaw is present in the Windows DNS Server component across all these releases.

The CVSS score of 8.8 indicates high severity, though the EPSS score is not available, making the likelihood of exploitation uncertain. The flaw is not listed in the CISA KEV catalog, but any exposed DNS Server can be targeted by an unauthenticated attacker over the network. Because the vulnerability can be triggered by sending a crafted DNS request, the attack surface is large and can be reached from external or internal networks, making the risk high for organizations that host public DNS services.