An out‑of‑bounds read flaw in the Windows DNS server software enables an attacker with local or network authority to trigger a denial of service. The vulnerability can lead to the DNS service crashing or becoming unresponsive, disrupting name resolution for clients that rely on the affected server.

Microsoft Windows Server 2012 and later, including the Server Core editions of Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, are vulnerable when running the built‑in DNS server component.

The CVSS score of 6.5 indicates a moderate‑to‑high severity vulnerability. The EPSS score is 1%, and the issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be network‑based, requiring an attacker who can send crafted DNS requests to the target. Because the flaw requires an authorized attacker, the risk is higher in environments where insider or local privilege threats exist, though the impact remains a denial of service rather than lateral movement or data exfiltration.