An out‑of‑bounds write in the Windows iSCSI subsystem enables an unauthenticated network attacker to run arbitrary code on the target machine. This results in full compromise of the affected system, allowing the attacker to steal data, modify or delete files, or install additional malware. The weakness is a classic memory corruption flaw (CWE‑787).

Affected products include Microsoft Windows 10 builds 1607, 1809, 21H2, and 22H2; Windows 11 builds 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions from 2012 through 2025, including server core deployments. The flaw impacts both 32‑bit and 64‑bit platforms where iSCSI is enabled.

The CVSS base score of 9.8 marks this flaw as critical, and while an EPSS score is not presently available, the lack of a KEV listing does not diminish the risk of exploitation. Attackers would need to reach the target over the network and interact with the iSCSI service, making the attack vector a remote network‑based exploitation. Given the remote nature and the high severity, organizations should treat this as a priority incident.