This use‑after‑free flaw in Windows Deployment Services enables an attacker to send crafted input over the network and cause the service to execute arbitrary code. The vulnerability is triggered when the service accesses memory that has already been freed, allowing the attacker to supply malicious data that hijacks program flow. An attacker who can reach the affected WDS instance can run code with the privileges of the service process, potentially gaining full control of the server.

The affected products are Microsoft Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including their Server Core installations. No additional version narrowing is available from the current data.

The CVSS v3 score of 8.1 classifies this fault as high severity, and the EPSS score is not available, indicating insufficient data on current exploitation activity. It is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a network‑based assault targeting the WDS service over its protocol endpoint, requiring the attacker to have connectivity to the server. No local privilege escalation is described, so a remote adversary who can reach the service port can exploit the flaw.