An out‑of‑bounds read occurs in the Windows DNS Server component, allowing an attacker with authorization to read memory beyond the intended buffer. The flaw can leak arbitrary internal data over the network, potentially exposing configuration details, credentials, or other sensitive information. CWE‑125 (Out‑of‑Bounds Read) categorizes this weakness as a memory safety issue that can result in unintended information disclosure.

The vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025. All listed builds are included regardless of language or architecture as indicated by the corresponding CPE entries.

The CVSS score of 6.5 places this issue in the Moderate severity range. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authorized attacker with network access to the affected DNS Server. Once the out‑of‑bounds read is triggered, the attacker can extract sensitive information from memory, leading to confidentiality compromise of internal system data. While the exploitability is limited to environments where the DNS Server component is exposed or misconfigured, the moderate risk level advises proactive mitigation.