The flaw is a stack‑based buffer overflow in the Windows Netlogon service, classified as CWE‑121. An attacker who can send a specifically crafted network request is able to overflow a buffer and execute arbitrary code with the privileges of the Netlogon service. This leads to a full compromise of the affected Windows Server, giving the attacker potential access to confidential data, ability to modify or delete files, and the capacity to disrupt service availability.

The vulnerable products are Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 edition, in both full and Server Core installations. All 64‑bit builds are affected.

The CVSS base score is 9.8, indicating critical severity. EPSS data is unavailable, and the vulnerability is not yet listed in the CISA KEV catalog. Because Netlogon operates over the network, the likely attack vector is a remote network attacker that can reach the affected servers on the Netlogon port (commonly 445). Exploitation requires the attacker to be able to send the malformed request to the server; no local privileges are required. The high severity score and remote reachability mean that this vulnerability poses an immediate and significant risk to any unpatched Windows Server environment.