The vulnerability is a null‑pointer dereference in the Remote Registry Service. An authorized attacker can trigger the service to crash over a network, causing a denial of service that disrupts registry‑related operations.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including their Server Core editions.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of 1% shows a low but non‑zero probability of exploitation. The attack requires an authorized local or network user; exploitation is therefore limited to environments where Remote Registry is enabled and is not currently listed in the CISA KEV catalog. The exploit path involves an authenticated network request that activates the null‑pointer bug and crashes the service.