The Windows SMB Server implementation can allocate resources without limits, and an attacker can send specially crafted requests to exhaust system resources. This leads to a denial of service that disrupts legitimate file sharing and network services. The flaw is an instance of uncontrolled resource consumption, resulting in impaired availability for all users of the affected server.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1; Microsoft Windows Server 2012, 2012 (Server Core), 2012 R2, 2012 R2 (Server Core), 2016, 2016 (Server Core), 2019, 2019 (Server Core), 2022, and 2025; plus ARM64‑based Windows 11 26H2. All listed operating systems are impacted.

The CVSS score of 7.5 indicates a high severity denial‑of‑service vulnerability. The EPSS score of 1% indicates a very low but nonzero probability of exploitation, but the lack of a KEV listing suggests no publicly known exploit yet; however the attack vector is inferred to be over the network because the SMB protocol is involved. An attacker can trigger the resource exhaustion by sending SMB traffic from any network segment with access to the target. The impact is limited to service availability, but the lack of throttle mechanisms could allow sustained outages.