An out‑of‑bounds read flaw in the DNS Server allows an authorized attacker to read data beyond the intended buffer, which can reveal sensitive information stored in memory. The weakness is classified as CWE‑125. The impact is primarily the unauthorized disclosure of internal configuration or other confidential data that the DNS server processes on the local system.

The vulnerability affects Microsoft Windows operating systems on both x86 and ARM64 architectures. Affected Windows 10 versions include 1607, 1809, 21H2, and 22H2. Windows 11 versions impacted are 23H2, 24H2, 25H2, and 26H1. Server editions affected are Windows Server 2016 (including core), Windows Server 2019 (including core), Windows Server 2022, and Windows Server 2025 (including core).

The CVSS score of 6.5 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack likely requires an authorized presence on the affected machine, such as a privileged user or malware with sufficient rights, to exploit the DNS Server. Given the need for local privilege, the true exploitability is moderate, but any compromise of DNS server memory could lead to data leakage.