The vulnerability is a buffer over‑read in the Windows DNS Server component. An attacker can cause the server to read beyond a buffer’s bounds and return sensitive data across the network. This flaw is categorized as CWE‑126 and results in information disclosure rather than code execution.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2012 through 2025, including 2012 R2, 2016, 2019, 2022, and 2025. All affected releases contain the DNS Server service and are listed by Microsoft as vulnerable to this buffer over‑read.

The CVSS score of 6.5 classifies this flaw as medium severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited active exploitation. Based on the description, it is inferred that an attacker can influence the DNS Server by sending crafted DNS queries that trigger the buffer over‑read, thereby disclosing sensitive data over the network. The flaw does not provide arbitrary code execution, so the primary impact is information disclosure. Mitigation should focus on applying Microsoft patches and restricting DNS service exposure.