The vulnerability is a heap-based buffer overflow in the Windows Internet Key Exchange (IKE) protocol, identified as CWE-122. An unauthenticated attacker can send specially crafted IKE packets to an affected host, causing an internal buffer to overflow and the IKE service to crash. The crash terminates the service so network traffic that relies on IKE is disrupted, leading to loss of connectivity for the host.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core). The affected releases run on x86, x64, and ARM64 architectures as enumerated in the CPE list.

The CVSS score of 7.5 classifies the threat as high severity. The EPSS score of less than 1% indicates low likelihood of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote over the network; an attacker can trigger the overflow by transmitting malicious IKE packets to the target without needing authentication or elevated privileges, resulting in a denial of service.