A memory leak arises in Windows Cryptographic Services when allocated memory is not released after its effective lifetime. Because the service processes network traffic, an attacker can send specially crafted messages that trigger this leak, gradually exhausting available memory and causing the service to become unresponsive. The flaw is identified as CWE-401 and results in a local denial of service that can be propagated to the host by exhausting system resources.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2, Microsoft Windows 11 versions 24H2, 25H2 and 26H1, and Microsoft Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025, including their Server Core installations. These operating systems and any network‑connected components running Windows Cryptographic Services must be reviewed for the presence of the vulnerability.

The CVSS score of 5.3 indicates medium severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, implying it is unlikely to be actively exploited. It can be triggered remotely over the network: an attacker can connect to the affected system, send crafted messages to the Windows Cryptographic Services that induce the memory leak until available memory is depleted. Once the leak runs out of memory, the service – and potentially the host – becomes unresponsive, leading to a denial of service.