The vulnerability is an out-of-bounds read in the Windows DNS Server component. This flaw allows an authorized attacker to read memory outside the intended buffer, leading to the disclosure of sensitive data over the network. Classified as CWE-125, the flaw can expose configuration details or other information that may aid further compromise.

Affected products include Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both full and Server Core installations.

The CVSS base score of 6.5 indicates moderate severity. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Because the flaw requires an attacker to be an authorized user on the affected system, the attack vector is limited to local or internal network contexts. Once exploiting the out-of-bounds read, an attacker can obtain arbitrary memory contents, potentially revealing sensitive network configuration or other valuable data.