The vulnerability is a use‑after‑free flaw (CWE‑416) in the Windows TCP/IP stack that allows an unauthenticated attacker to execute arbitrary code on an affected system without local privileges. The flaw enables the attacker to trigger freed memory via crafted network traffic and inject malicious code, leading to a full compromise of the host.

Affected systems are Microsoft Windows operating systems including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and Server Core installations). The flaw spans both x86 and x64 architectures, as well as ARM64 for qualifying Windows 11 versions.

With a CVSS score of 8.1, the vulnerability is considered high severity. The EPSS score of 0.00552 indicates a very low exploitation probability, and it is not listed in the CISA KEV catalog, indicating no confirmed exploitation yet. The attack path is assumed to be remote over the network, leveraging the Windows TCP/IP stack; thus any host exposed to external networks without the patch is at risk. Until a vendor fix is applied, the flaw offers full remote code execution with no authentication requirements.