The vulnerability is a heap‑based buffer overflow in Microsoft Network Policy Server that permits an unauthenticated network attacker to execute arbitrary code with the privileges of the NPS service. This flaw is classified under CWE‑122 and CWE‑191. Successful exploitation jeopardizes the confidentiality, integrity, and availability of the affected system, enabling full remote code execution on the host.

Affected products include Microsoft Windows 10 build 1607, 1809, 21H2, 22H2; Microsoft Windows 11 builds 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, both full and core installations. The flaw resides in the Network Policy Server component present in these versions.

The CVSS score of 9.8 marks this as critical. No EPSS value is provided, so the known likelihood of exploitation remains unknown, but the fact that the flaw permits remote code execution over a network underscores the high risk. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires sufficient network connectivity to the NPS service, enabling an attacker to craft a malicious packet that overflows the service’s heap buffer and gains code execution on the host.