The vulnerability is an out‑of‑bounds read in the Microsoft DNS server that permits an authorized attacker to read memory contents and produce sensitive data over the network. The weakness is classified as CWE‑125 and results in the disclosure of information that should remain private, potentially compromising confidentiality of the system and its network environment.

Affected Microsoft products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (both full and Server Core installations). These include both x86 and x64 builds as well as ARM64 builds for Windows 11. The vulnerability is present in the built‑in DNS server component of each of these operating systems.

The elevated risk in sensitive environments stems from the fact that the attacker need only be authorized on the network, which is a common attack scenario in many corporate or virtualization setups. As no publicly available exploits are disclosed, the main threat comes from potential creation of custom exploitation tools by threat actors.