A stack‑based buffer overflow exists in the Windows Netlogon service that allows an attacker who can transmit a specially crafted network payload to execute arbitrary code on the target server. The description does not specify the privilege level that the attacker would obtain, but the ability to run code remotely is a severe compromise risk that could potentially lead to further exploitation or data modification.

The affected products are Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022 (including the 23H2 edition), and 2025, including their Server Core installations, all on 64‑bit builds.

The CVSS base score of 9.8 indicates critical severity. The EPSS score of 44% suggests a high probability that this vulnerability is or will be actively exploited. It is currently not listed in the CISA KEV catalog. Because Netlogon operates over TCP 445, the likely attack vector is inferred to be a remote attacker who can reach the affected server on that port. Exploitation requires no local privileges and relies solely on network access to deliver the malformed request.