Allocation of resources in Windows Netlogon occurs without any limits or throttling. This creates a resource exhaustion flaw that can consume memory and processing capacity, causing the Netlogon service to crash or become unresponsive. Because the flaw is triggered by standard network requests, an attacker who can reach the target system can exhaust these resources and deny legitimate users the ability to authenticate or join the domain. The weakness is classified as a CWE‑770 flaw – allocation of resources without limits.

The issue appears in multiple Microsoft Windows products. It affects Windows 10 versions 1607, 1809, 21 H2, and 22 H2; Windows 11 releases 23 H2, 24 H2, 25 H2, 26 H2, and 26 H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both normal and server‑core installations. Accordingly, any domain‑controller or system that runs these OS versions and uses the Netlogon RPC service is potentially vulnerable.

The vulnerability has a CVSS v3.1 score of 6.5, indicating a moderate impact if exploited. The EPSS score is 1%, and the issue is not listed in the CISA KEV catalog, suggesting that large‑scale exploitation has not yet been observed. Based on the description, the likely attack vector is sending a large volume of legitimate Netlogon RPC requests over the network, which an attacker can do from any system with network connectivity to the vulnerable host. Because the flaw can be triggered by standard network traffic and does not require elevated privileges, the likelihood of service disruption in a target environment is significant, particularly in dense domain environments or where external traffic is allowed. An attacker who sends numerous Netlogon requests can deplete system resources, causing authentication failures and intermittent network downtime.