The flaw is a use‑after‑free vulnerability in the Windows Network Controller (NC) Host Agent that allows an attacker with authorized local privileges to cause the service to terminate and refuse to restart, resulting in a local denial of service. The weakness falls under CWE‑416 and CWE‑822, showing that unsafe memory handling can lead to a loss of service.

Microsoft Windows Server 2019, Windows Server 2022, and Windows Server 2025 including their Server Core installations are affected. No specific sub‑versions are listed; all listed releases are vulnerable until a patch is deployed.

The CVSS score of 5.5 indicates a moderate severity, and with no EPSS data the likelihood of exploitation is uncertain, though the flaw requires local authorized access. It is not present in the CISA KEV catalog, implying no widespread exploitation has been documented. An attacker who can obtain local privileged credentials can exploit the vulnerability to repeatedly crash the NC Host Agent and disrupt network controller operations.