The vulnerability is an integer underflow in Windows Performance Monitor that allows an unauthorized attacker to execute code remotely, resulting in full remote code execution. This flaw is a classic integer wrap or wraparound failure (CWE-190) that can be exploited to take control of the affected system.

Affected hosts include Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1 as well as Windows Server 2022 and Windows Server 2025 deployments, on both x64 and arm64 architectures.

With a CVSS score of 8.1, the vulnerability is considered Severe. EPSS data is not available, and the flaw is not yet listed in CISA’s KEV catalog. The likely attack vector is a remote network connection to the Performance Monitor service; an attacker with network access can craft input that triggers the integer underflow and gain code execution capability. The threat is high because the vulnerability can be exploited without authentication and by any host that can reach the service.