An integer underflow (wrap or wraparound) in the Windows Failover Cluster component can cause the cluster to become unresponsive, effectively denying service to legitimate users. The flaw falls under CWE‑191 and permits an unauthorized attacker to trigger a network‑based denial of service, disrupting access to shared resources hosted by the cluster.

The vulnerability affects Microsoft Windows Server 2019, Windows Server 2022, Windows Server 2025, and the corresponding Server Core installations. These operating systems currently expose the Failover Cluster service to network interactions that can be exploited.

With a CVSS score of 7.5 the flaw represents a high impact severity, though the EPSS score is not available at this time, and it is not listed in the CISA KEV catalog. The likely attack vector involves an attacker sending specially crafted network traffic to the cluster’s control interface to trigger the integer underflow, as the description indicates an unauthorized attacker can deny service over a network. No additional safeguards or prerequisites are specified in the provided data.