The Microsoft DNS Server component contains a heap‑based buffer overflow (CWE‑122). An adversary who can send DNS queries to the vulnerable server can craft a request that overflows a heap buffer, causing the server to reveal sensitive data from memory over the network. The flaw does not grant remote code execution or privilege escalation; it allows only the disclosure of memory contents as returned in DNS responses or logs.

Affected Windows environments include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022 and 2025. All listed variants, regardless of architecture, are impacted.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The likely attack vector requires that the attacker be authorized to send queries to the DNS Server or that a host within the network be compromised; thus the risk is elevated for internal users or compromised hosts that can reach the service. Successful exploitation would allow data leakage but does not provide direct code execution or widespread compromise.