Integer overflow or wraparound in Windows iSCSI allows an attacker to execute code over a network. The flaw arises when untrusted data is processed without proper bounds checking, resulting in a memory corruption that an unauthorized client can trigger. This leads to full remote code execution with the privileges of the iSCSI service, enabling an attacker to take control of the affected Windows system.

Affected vendors include Microsoft, with impacted products ranging from Windows 10 Version 1607 to Windows 11 Version 26H1, and Windows Server 2012 through Windows Server 2025. Specific versions listed are Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (including Server Core installations).

The vulnerability was scored a 8.8 on CVSS, indicating a high severity. The EPSS score is not available, so current exploitation likelihood is uncertain. The CVE is not listed in CISA’s KEV catalog, meaning no confirmed exploitation to date. The description notes that the overflow can be triggered by an unauthorized network client, so the attack requires network access to the Windows iSCSI service; no local privileges are mentioned.