This vulnerability is an out-of-bounds read in the DNS Server component of Windows Server. The flaw can cause the DNS Service to crash, resulting in a denial of service to clients that rely on the server for name resolution. Because the reading operation occurs outside the bounds of a legitimate buffer, a malformed DNS response that an attacker can submit with sufficient privileges will trigger an abrupt termination of the DNS Service.

The flaw affects Microsoft Windows Server 2012 through Windows Server 2025, including Server Core installations. The impacted services are the DNS Server role installed on any Windows Server within these version ranges.

A CVSS score of 6.5 reflects a moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to require an attacker who already has authorized access to the network or the DNS server itself; such an attacker can inject the crafted DNS response that triggers the out-of-bounds read, leading to a service crash.