The vulnerability is an out‑of‑bounds read error in the Windows DNS Server component. When an authorized user sends a specially crafted DNS request, the out‑of‑bounds read causes the server process to crash, thereby stopping all DNS services on the host. The result is a loss of availability for any clients that rely on that DNS server, as queries will fail and resolution will be disrupted.

This issue impacts Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, for both full‑installation and Server Core images, on 64‑bit platforms. Affected versions can be identified in the known CPE entries for each operating system.

The CVSS score of 6.5 represents a moderately high severity, and the EPSS score of 1% indicates a low, but not negligible, likelihood that the flaw will be exploited in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation at present. Attack requires the adversary to have authorized access to the DNS Server, such as being a user with local administrator rights or a compromised authenticated account. The flaw is triggered by an active network request to the DNS port, so a network‑based attacker with sufficient privileges can send the malicious packet from the same network to exploit the read and crash the service.