The vulnerability is an infinite loop in the Active Directory Federation Services component caused by an unreachable exit condition. The loop consumes CPU resources without termination, rendering the AD FS service unresponsive to legitimate requests of service. This weakness is classified as CWE‑835 and represents a failure in control flow that allows code to spin endlessly.

Affected systems encompass Microsoft Windows 10 versions 1607 and 1809, as well as Windows Server releases 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations. The flaw applies to the AD FS role installed on each of these operating systems. In addition, the vulnerability also affects Microsoft .NET Framework 3.5 through 4.8 and the 4.8.1 version that is utilized by AD FS.

With a CVSS score of 5.9 the vulnerability has moderate impact, and an EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. Nevertheless, an attacker who can reach the AD FS endpoint over the network could trigger the infinite loop and temporarily disrupt authentication services and any downstream applications that rely on AD FS.