An out‑of‑bounds read in the DNS Server component allows an authorized attacker to read data that should be inaccessible. The vulnerability can expose sensitive information that traverses the network, resulting in a compromise of confidentiality. The weakness is identified as a Buffer Under-read, classified by CWE‑125, and the CVSS score of 6.5 indicates a moderate security impact. The attack requires the attacker to have authorized access to the system or to a network segment that can reach the DNS service, meaning the threat is limited to environments where an attacker has some level of legitimate connectivity to the target.

The flaw would affect a broad set of Microsoft Windows operating systems, including Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (duplicate entry), 26H1, and multiple Windows Server releases from 2012 through 2025, including server core installations. This includes both standard x86/x64 architectures and ARM64 variants where noted.

With a CVSS score of 6.5, the vulnerability represents a moderate risk; however, the lack of an EPSS score and the absence from the CISA KEV catalog reduce the perceived likelihood of immediate exploitation. The attack vector is inferred to be local or remote, depending on how the attacker gains authorized access to the DNS Server or the network segment in which it operates. The threat is significant in scenarios where sensitive configuration or memory content could be read through the out‑of‑bounds access, although the vulnerability does not appear to permit code execution or denial of service.