This vulnerability is a null pointer dereference in Windows Active Directory Domain Services that can cause the service to terminate unexpectedly. The effect is a denial of service to domain controller functionality, which can disrupt authentication, authorization, and directory queries for users and applications. The flaw is a classic memory handling error (CWE‑476) that can be triggered by input that the service fails to validate before dereferencing a pointer, leading to a crash. The official CVE description confirms that an attacker who already has authorization within the domain can exploit this defect over the network to bring down the service.

The flaw affects Windows 10 and Windows 11 clients from versions 1607 through 26H1, as well as a range of Windows Server editions from 2012 to 2025, including server core installations. All listed Windows operating systems that run Active Directory Domain Services are therefore susceptible until the Microsoft patch is applied.

The CVSS score of 6.5 indicates a medium severity. Exploit probability data (EPSS) is not available, and the vulnerability is not listed in the CISA KEV catalog. Given that the flaw requires authorized domain access and is delivered over the network, it is plausible that an attacker with legitimate credentials or one who has compromised a trusted account could trigger it. The risk is moderate, but if the domain controller experiences repeated crashes, it could result in significant downtime for an organization’s identity services.