The vulnerability is an out‑of‑bounds read in the Windows DNS Server code. It allows an authorized attacker to read arbitrary memory and transmit that data over a network, resulting in disclosure of sensitive information. This flaw is a classic CWE‑125 bad pointer reads scenario that can compromise confidentiality of the system.

Affected products are Microsoft Windows operating systems including Windows 10 versions 1607, 1809, 21 H2, 22 H2; Windows 11 versions 23 H2, 24 H2, 25 H2, 26 H2, 26 H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022 and 2025.

The CVSS score is 6.5, indicating moderate severity, and the EPSS score is not available while the vulnerability is not listed in CISA KEV. Exploitation requires that the attacker already has authorized access to the DNS server, so the attack vector is local or requires network access with sufficient privileges. Given the moderate score and the limited attack surface, the likelihood of exploitation is lower than for public remote vulnerabilities, but the potential impact on confidentiality warrants patching as soon as possible.