An unauthorized attacker can cause a denial of service by exploiting an unchecked allocation of resources in OpenSSH for Windows. The flaw permits the attacker to drain system resources through crafted network requests to the OpenSSH service, thereby interrupting normal operation and making the targeted machine unavailable. The primary weakness involved is an unbounded resource allocation, identified as CWE-770.

The vulnerability affects Microsoft Windows 10 versions 1809, 21H2, and 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, and Microsoft Windows Server 2025 (Server Core installation). All listed builds are susceptible when the OpenSSH for Windows component is installed and enabled.

With a CVSS score of 7.5, the vulnerability is considered high risk. The EPSS score is 1% and the issue is not listed in the CISA KEV catalog, but the lack of active protection implies that the flaw remains exploitable. The likely attack vector is a remote network connection to the OpenSSH service, where an attacker sends a malicious SSH session that triggers excessive resource consumption. Successful exploitation results in a loss of availability for the affected system, impacting any services relying on that host.