The vulnerability is a missing release of memory after the effective lifetime in Windows’ Internet Key Exchange (IKE) Protocol, causing an unauthorized attacker to trigger a denial‑of‑service condition over a network. The memory leak can exhaust system resources, potentially leading to the crash of the IKE service or the entire operating system, thereby rendering the affected machine unavailable to legitimate users.

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 22H3, 26H1), and Windows Server editions from 2012 through 2025—including Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, Server 2025, and Server 23H2—are impacted by this flaw.

The CVSS score of 7.5 reflects a high impact with a network access vector, implying that a remote attacker can exploit the IKE protocol over UDP to trigger the memory leak. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been observed yet, but the high severity warrants timely mitigation. An attacker would need to send crafted IKE packets to the vulnerable system; no exploitation code is currently publicised, making the likelihood moderate to high until the patch rolls out.