An out-of-bounds read within Microsoft DNS Server allows an authorized attacker to read arbitrary memory contents, potentially exposing sensitive configuration or system data across the network. The flaw, identified as CWE-125, means that when the server processes certain DNS queries, it may read beyond the bounds of a buffer and leak data that should remain private. While the description does not specify the exact type of data exposed, the ability to read memory can lead to confidentiality compromises such as credential leakage or system configuration insight.

Affected products include various Microsoft Windows operating systems and Server editions, such as Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025. Both Server Core and full installations are impacted. These versions span a wide range of releases, implying that many organizations may still run vulnerable systems without awareness.

With a CVSS score of 6.5, the vulnerability presents moderate severity. The EPSS score is not available and the flaw is not yet catalogued in CISA's KEV list, suggesting no known widespread active exploitation yet. However, because the exploit requires an authorized presence on the network and the DNS server, it is likely that attackers will leverage compromised credentials or insider threats to trigger it. Prevention through timely patching and access restriction mitigates the risk effectively.