The vulnerability is an out‑of‑bounds read in the Windows DNS Server that permits an attacker with authorized access to retrieve sensitive data over the network. The flaw originates from improper bounds checking and can expose memory contents, potentially revealing configuration, internal state, or other private information. This represents an information‑disclosure weakness (CWE‑125) that does not allow code execution or denial of service but compromises confidentiality of data that can be accessed by the attacker.

Affected systems include Microsoft Windows 10 from version 1607 through 22H2, Windows 11 from version 23H2 through 26H2, and various Windows Server releases such as 2012, 2012 R2, 2016, 2019, 2022, and 2025. Both full and core installations of the Windows Server family are impacted. All affected builds provide a DNS Server service that is vulnerable.

The CVSS score of 6.5 indicates a moderate risk. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread exploitation has been observed as of this analysis. Because the attack requires authorized authentication, the likelihood of exploitation is limited to compromised or privileged accounts; however, once an attacker has access to the corporate network, the vulnerability can be leveraged to read memory of the DNS Server process, exposing potentially sensitive network information. There are currently no publicly available exploit tools, and the best mitigation is to apply the Microsoft patch promptly.