A null pointer dereference occurs within the Windows Storport Miniport Driver, allowing an unauthorized attacker to cause a denial of service over a network. The flaw is a classic use‑after‑free type issue (CWE‑476) that can crash the driver and terminate storage services, leading to loss of availability for any systems relying on those services.

The vulnerability affects Microsoft Windows Server 2025, including the Server Core installation. No specific firmware or patch versions are listed in the advisory, so all releases of these products may be impacted until a fix is applied.

With a CVSS score of 6.5 the weakness is considered medium severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, suggesting the threat may not be actively exploited yet. However, the ability to trigger a DoS remotely means an attacker with network access to the affected host can disrupt service without additional privileges. The attack vector is inferred from the description – the denial of service can be triggered over the network by an unauthorized attacker.