The vulnerability is a pointer dereference flaw (CWE-822) in the DNS Server that can be triggered by an external user who crafts and sends a specially formatted query. When this flaw occurs, the server blindly follows a pointer supplied by the attacker, which can lead to arbitrary code execution with the privileges of the DNS process. This allows the attacker to compromise the host running the DNS service, potentially giving full system control over the affected machine.

Microsoft Windows 10 builds 1607, 1809, 21H2, 22H2; Windows 11 builds 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2016, Server Core 2016, 2019, Server Core 2019, 2022, 2025, Server Core 2025. These include the standard x86, x64, arm64 platforms as listed in the CPE strings.

The CVSS score of 8.8 places this issue in the high‑severity range. Although the EPSS score is not available, the lack of a KEV listing suggests no confirmed widespread exploitation yet, but the flaw remains reachable over the network and can be exploited remotely with no authentication. An attacker with network access to the DNS service could trigger the vulnerability at any time, leading to compromise of the server and potentially lateral movement within the network.