A heap-based buffer overflow in the Windows SMB Server component allows an attacker who has network reachability to an authorized server to trigger arbitrary code execution. The flaw occurs when the server processes certain SMBv3 requests, leading to memory corruption and execution of attacker-controlled code. This vulnerability can compromise confidentiality, integrity, and availability by enabling full control of the affected host.

The affected products are Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations).

The vulnerability has a CVSS score of 8.8, indicating high severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog. Exploitation requires network access to an authorized SMBv3 server, making the attack vector local or authenticated within the network. Because the flaw allows arbitrary code execution, the risk to privileged systems remains significant, especially where SMBv3 traffic is allowed from potentially untrusted hosts.