Technical impact
The vulnerability is a use‑after‑free in the Windows Virtual Filtering Platform component. An attacker who has local or network‑level privilege can cause a resource exhaustion that results in a denial of service to network traffic handled by VFP. The exploit does not grant code execution or privilege escalation; it simply disrupts normal filtering operations, impacting availability of the affected system and potentially degrading packet inspection for connected devices.
Affected Systems
Affected Release and build: Windows 10 starting from version 1607 through 22H2, Windows 11 from version 24H2 through 26H1, plus Windows Server 2016, 2019, 2022, and 2025 (including Server Core installations). All bit‑modes represented. These versions include the VFP driver that contains the insecure memory handling. No other platform or architecture is currently known to be vulnerable.
Risk and Exploitability
The CVSS score of 5.3 indicates a medium impact when combined with the low EPSS (<1%) and the fact that the vulnerability is not listed in CISA KEV. Exploitation requires a legitimate user context that can send malicious traffic to the VFP service, so the likely attack vector is network‑based within a trusted environment. Given the limited exploitation probability, organizations should prioritize patching but can monitor for abnormal filtering service resets.
