An out‑of‑bounds read in the Windows DNS Server allows an attacker with network access to retrieve sensitive contents beyond the intended buffer, exposing cached DNS records, cryptographic keys, or arbitrary memory data, which can be leveraged for further attacks. The flaw is classified as CWE‑125.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, including both full and Server Core installations.

The CVSS score of 6.5 indicates moderate severity. Although the EPSS score is not available, the flaw requires an authorized attacker with network-level access to the DNS service. The vulnerability is not in the CISA KEV catalogue, suggesting that no widespread exploitation has been observed, but the moderate score and network‑based attack vector warrant immediate remediation.