This vulnerability involves an out-of-bounds read within the DNS Server component. It allows an attacker who can send DNS requests with crafted payloads to read memory that is not intended to be exposed, which may reveal sensitive data. The weakness is a classic buffer over-read vulnerability identified by CWE-125, compromising confidentiality of data on the affected system.

The flaw impacts a wide range of Windows operating systems including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 in both standard and Server Core installations. All referenced Microsoft products are affected.

The CVSS score of 6.5 places the vulnerability in the medium severity category, and the current EPSS score is unavailable, meaning the likelihood of real-world exploitation cannot be quantified at this time. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a network-based scenario where an authorized attacker—one who can reach the DNS Server—sends specially crafted queries that trigger the read. The lack of elevation requirements suggests physical or privileged local access is not required; however, the attacker must be able to communicate with the target DNS service to exploit this flaw.