This vulnerability is a heap-based buffer overflow (CWE-122) in the Windows Resilient File System (ReFS), allowing an authorized attacker to execute arbitrary code over a network connection. The flaw can lead to full compromise of confidentiality, integrity, and availability on affected systems by permitting the attacker to run malicious instructions with the privileges of the executing process.

Affected systems include Microsoft Windows 11 versions 23H2, 24H2, 25H2 and 22H3, as well as Microsoft Windows Server 2022, the 2022 23H2 Server Core edition, and Microsoft Windows Server 2025 in both standard and Server Core installations. All of these product lines expose the ReFS component that contains the heap overflow bug.

The CVSS score of 8.8 indicates high severity, and the EPSS score of < 1% suggests that exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers must have authorized network access to an affected system and require sufficient privileges to trigger the overflow, implying the risk applies primarily to systems already compromised or to privileged users on the network.