Microsoft DNS Server contains an out-of-bounds read that an attacker can trigger to force the service to crash, resulting in a denial of service on the DNS server. This vulnerability is allows an attacker to disrupt name resolution for clients relying on the affected DNS service, potentially cascading into broader network outages. The impact is limited to service availability without direct exfiltration or code execution, but an unavailable DNS service can cripple mission‑critical applications and client connectivity.

The flaw affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both full and Server Core installations, across all supported x64 editions as identified by the vendor’s product list. Anyone deploying these operating systems with the default DNS Server role is potentially exposed unless mitigated.

The published CVSS score of 6.5 describes a moderate severity vulnerability. The EPSS score of 1% indicates a low, but non‑zero probability of exploitation. The issue is not listed in CISA’s KEV catalog, suggesting no confirmed active exploits. The likely attack vector is via a remote, authorized user sending crafted DNS queries to the vulnerable server. Successful exploitation requires the attacker to be able to send such queries, which may arise in environments where the DNS service accepts requests from internal or partially trusted networks. Given these conditions, the risk is primarily availability loss rather than compromise of confidentiality or integrity.