The vulnerability is an out‑of‑bounds read (CWE‑125) in the Windows DNS Server. An attacker who is authorized to query the DNS service can cause the server to read beyond allocated memory and disclose sensitive data that resides in the same process address space. The disclosed information can reveal internal configuration details or other data useful to further attacks.

Affected Microsoft products include Windows 10 releases 1607, 1809, 21H2, 22H2, Windows 11 releases 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025 (including Server Core installations). The vulnerability impacts both x86 and ARM64 architectures across these editions where the DNS Server component is deployed.

The CVSS score of 6.5 indicates moderate severity. Because the EPSS score is not available, the precise likelihood of exploitation is unknown, but the CVE is not currently listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. The attack requires an authorized user who can send crafted DNS queries to the server, meaning the risk is higher in environments where administrators have broad DNS query privileges or where the DNS service is exposed to untrusted networks. Organizations should treat this as a moderate risk until the patch is applied.