The vulnerability is an out‑of‑bounds read in the DNS Server component of Microsoft Windows operating systems. An attacker who has authorization to send DNS queries can read memory outside intended bounds, causing disclosure of sensitive data that may include system state or configuration. This is a CWE‑125 Buffer Under‑read weakness, providing partial information exposure that could aid further attacks.

Affected Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, including all flavours such as Server Core. All listed versions are susceptible to the DNS Server information disclosure flaw.

The CVSS score of 6.5 indicates a moderate level of severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the attacker can reach the DNS Server and send a crafted request. The outcome is the leakage of arbitrary memory content, which may expose credentials or configuration data. Because the vector depends on network access to the DNS service, the risk is elevated for hosts with publicly exposed or poorly segmented DNS servers.