The vulnerability is a stack‑based buffer overflow in Windows Internet Information Services that lets an unauthorized attacker execute arbitrary code over a network. The flaw arises from insufficient input validation, allowing the overwrite of control data on the stack (CWE‑121 and CWE‑20). Successful exploitation could give the attacker full system control on the affected machine, compromising confidentiality, integrity, and availability.

Affected Windows operating systems include Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025, covering both standard and Server Core installations. The vulnerability impacts all processor architectures listed in the CPE data and applies to any machine running IIS with these OS versions.

The CVSS score of 9.8 indicates a very high severity with the potential for full system compromise. EPSS data is not available, but the exploitation does not require prior knowledge of the system, and the CVE is not listed in the CISA KEV catalog, suggesting no publicly known active exploits at this time. Based on the description, the likely attack vector is over an untrusted network to the IIS service; an attacker only needs network connectivity to the IIS web server to send specially crafted requests that trigger the overflow.