A null pointer dereference within the Kerberos protocol implementation can be triggered by an authenticated user to cause a denial of service. Attackers need valid credentials to initiate the exploit. The fault leads the Kerberos service to crash or become unresponsive, disrupting authentication for the host.

Affected are Microsoft Windows 10 builds 1607, 1809, 21H2, 22H2, Windows 11 builds 23H2, 24H2, 25H2, 26H1, as well as Windows Server 2012 through 2025, including core installations. All listed variants are impacted. No specific sub‑version or build numbers beyond those enumerated are indicated in the data.

The CVSS score of 6.5 indicates a moderate severity. With no EPSS score available and the issue absent from the CISA KEV catalog, the likelihood of active exploitation appears limited at present. Because the exploit requires an authorized account, the attack vector is local or remote but privileged, meaning that compromised or legitimate user credentials can trigger the denial of service.