The vulnerability is a heap-based buffer overflow in the Windows iSCSI subsystem that enables an attacker to trigger a denial‑of‑service condition. The overflow lets an attacker cause a crash of the iSCSI service, resulting in significant interruption of network file‑sharing services and potential loss of session continuity for clients that rely on iSCSI. The impact is confined to service availability and does not directly expose confidential data or allow remote code execution.

Affected systems include Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 23H2, 24H2, 25H2, 26H2, and 26H1), as well as Windows Server 2012 through Server 2025, including Server Core installations.

The CVSS score of 7.5 signals a high severity of availability impact. The EPSS score of 1% indicates a very low but nonzero probability of exploitation, while the vulnerability is publicly disclosed and not listed in the CISA KEV catalog. The attack vector is inferred to be remote over the network, as the buffer overflow occurs in a network-facing component of the iSCSI stack. With no authentication requirement highlighted, an attacker can exploit the flaw from any network location that can reach the target’s iSCSI service, making mitigation a priority for exposed servers.