An untrusted pointer dereference in Windows DNS Server permits an attacker to execute arbitrary code remotely. This flaw falls under CWE-822, indicating a memory corruption weakness that can be abused without initial authentication. The vulnerability can compromise confidentiality, integrity, and availability of the affected machine if successfully exploited.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2016, 2019, 2022, and 2025. Both client and server operating systems host vulnerable DNS Server components and are therefore at risk if not patched.

The CVSS score of 8.8 marks the flaw as high severity, and although the EPSS score is not available, the absence of a KEV listing suggests no known active exploitation yet. The likely attack vector is remote over a network via crafted DNS queries, allowing an unauthorized attacker to trigger the pointer dereference. Because the vulnerability can be triggered without local or authenticated access, any external DNS service operator must evaluate the risk promptly.