Windows Netlogon contains a use‑after‑free flaw that allows an attacker with network access to trigger a denial of service. The flaw enables the attacker to disrupt Netlogon processing, causing the target system to become unresponsive or to restart. Based on the description, the attacker must already be authenticated to the network; the attack is likely carried out over the Netlogon service and can lead to loss of availability for authentication services, affecting the entire domain.

The vulnerability impacts Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1. It also affects Windows Server 2012, 2016, 2019, 2022 and 2025 in both full and server‑core installations. The flaw is present on x86, x64 and arm64 architectures as indicated by the affected CPE list.

The CVSS score of 5.3 places the vulnerability in the medium severity range. EPSS data are unavailable, indicating uncertainty about its exploitation probability at present. The flaw is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The attack vector is likely remote over the network; because the flaw requires an authorized network attacker, it may require possession of valid domain credentials. If successful, the attacker can cause a denial of service of the Netlogon service, leading to authentication failures and service disruption across the domain.