The vulnerability is an out‑of‑bounds read in the Windows DNS server that allows an authorized attacker to read arbitrary memory contents. The flaw enables disclosure of confidential data, such as cache contents or sensitive configuration information, to the attacker’s machine. The impact is strictly a confidentiality breach, with no integrity or availability effects noted in the description.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations). Both x86, x64, and ARM64 architectures are affected, covering common desktop and server deployments.

The CVSS base score of 6.5 denotes moderate severity, but the EPSS score is not available, so the current probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly confirmed, widespread exploitation as of the last update. Based on the description, the likely attack vector is a local or network attacker who can send specially crafted DNS queries to a vulnerable server; no remote unauthenticated exploitation is implied. The authenticated nature of the threat suggests that the attacker must have access to the internal network or the DNS server itself, but a patch is required to eliminate the memory read flaw.