An incorrect calculation of buffer size within the Windows VMSwitch component enables an authorized attacker to cause a denial of service locally. This buffer size miscalculation aligns with CWE‑131. As a result, the VMSwitch can consume incorrect memory or crash, causing network services on the affected host to become unavailable to legitimate users. The impact is a local denial of service, disrupting local network connectivity.

Microsoft Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2, 25H2, 26H1, Windows Server 2022, and Windows Server 2025 (including Server Core installations).

The CVSS score of 5.5 indicates moderate severity. The EPSS score is <1%, signifying a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The expected attack vector is a local authorized user with sufficient privileges to interact with the VMSwitch component; remote exploitation from the internet without local access is not supported. Thus, the exploitation path requires legitimate local credentials to trigger the buffer size miscalculation.