The vulnerability is a type‑confusion flaw in the RPC Runtime that allows an attacker who can send specially crafted RPC requests to a target system to coerce the runtime into interpreting data as a different type. This misinterpretation can lead to arbitrary code execution on the affected machine with the privileges of the RPC service, enabling full compromise of the host. The flaw is classified as a remote‑code‑execution vulnerability (CWE‑843).

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1; Microsoft Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, and Server 2025 (including Server Core installations).

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, so the quantified likelihood of exploitation is unknown, but the lack of listing in CISA's KEV catalog suggests that no widespread exploitation has been reported yet. The attack vector is inferred to be remote, via network traffic to the RPC service. Because this flaw can allow execution of arbitrary code, it poses a risk to confidentiality, integrity, and availability across the affected systems.