This vulnerability is a heap‑based buffer overflow in the Windows iSCSI implementation. An attacker who can send specially crafted iSCSI packets to a vulnerable host can cause the overflow and execute arbitrary code with the privileges of the iSCSI service. The weakness is consistent with CWE‑122 and can compromise confidentiality, integrity, and availability on the affected machine.

Affected products are Microsoft Windows 10 and Windows 11 across many releases—including 1607, 1809, 21H2, 22H2 for Windows 10 and 23H2, 24H2, 25H2, 26H2, 26H1 for Windows 11. Server editions affected include Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and core installations). The CPE data also notes support for both x86, x64, and arm64 architectures where applicable.

The CVSS score of 9.8 signals a critical vulnerability. No EPSS data is available, so the current exploitation probability is unknown, but the vulnerability can be triggered remotely over the network using the iSCSI protocol, making it potentially exploitable by adversaries with network visibility or control. The vulnerability is not listed in the CISA KEV catalog at this time, but its impact warrants close monitoring and rapid mitigation.