A heap-based buffer overflow in the Windows iSCSI Target Service allows an unauthorized attacker to execute arbitrary code over a network. The flaw permits direct code execution, compromising confidentiality, integrity, and availability of the affected system. The description indicates that no privilege escalation is required beyond network access, meaning any remote host able to communicate with the target can exploit the weakness.

The vulnerability affects multiple Microsoft Windows releases: Windows 10 Version 1607 and Version 1809; Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, and Server 2025, including both standard and Server Core installations. All listed builds are vulnerable unless a patch has been applied.

The CVSS score of 9.8 classifies this as critical, and the EPSS score is not available, but the lack of a KEV listing does not reduce the urgency. The attack vector is inferred to be network-based, exploiting the iSCSI service from remote hosts. Because the flaw is a classic buffer overflow in a system service, exploitation is plausible for attackers with network access to the target.