The vulnerability is an out‑of‑bounds read in the Windows DNS Server that allows an authorized attacker to read memory contents and disclose sensitive data on the network. The flaw is classified as CWE‑125 and can lead to the exposure of confidential configuration or user information. Because it is an information‑disclosure flaw, the attacker learns details that could aid further attacks, such as credential or system configuration data.

Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions from 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both standard and Server Core installations. The list covers both 32‑bit and 64‑bit builds and ARM64 architectures where applicable. No specific sub‑versions or patch levels are identified in the data.

The CVSS score of 6.5 indicates a moderate severity, and because the EPSS score is not available, the current evidence of exploitation is unknown. The flaw requires the attacker to have authorized access to the Windows DNS Server and to send crafted queries, so exploitation is limited to network‑present attackers. The vulnerability is not currently listed in the CISA KEV catalog, but the lack of a publicly available patch means users should treat exposure as a potential risk and consider mitigations while awaiting an official fix.