The vulnerability is a heap‑based buffer overflow in the Windows iSCSI component, allowing an attacker to inject malicious code into the system’s memory space. Because the flaw is triggered by abnormal network traffic addressed to the iSCSI service, a malicious actor can remotely craft packets that overflow a buffer, execute arbitrary instructions, and gain full control of the affected system. The weakness is classified as CWE‑122 and impacts confidentiality, integrity, and availability of the host.

Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations. These versions host the vulnerable iSCSI service and have been enumerated by the CNA as affected.

The CVSS score of 7.5 reflects a high severity with network attack vector. The EPSS score is not available, and the vulnerability has not yet been reported in CISA’s KEV catalog, which suggests no widespread industrial exploitation yet. However, remote exploitation requires the attacker to directly target the iSCSI port, so strong network perimeter controls can reduce risk. If the service is exposed to untrusted networks, the attacker’s potential to gain full system compromise remains significant.