An untrusted pointer dereference in the Windows kernel can cause the system to crash when triggered by an attacker who has authorized access. The flaw is a classic dereference of an invalid memory address, which results in a kernel panic and termination of the operating system, thereby disabling all services on the host. The impact is a complete denial of service, disrupting all processes that rely on the operating system kernel.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, 2025, including both full and Server Core installations. These affected releases are listed by Microsoft in the official advisory and cover both x86 and x64 architectures, as well as ARM64 where applicable.

The CVSS score is 6.5, indicating a moderate severity. The EPSS score is 1%, and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting no confirmed exploitation in the wild. The attack vector is inferred to be over the network, as the description notes denial of service “over a network.” An attacker with authorized access—such as a user with privileged credentials or a compromised system—could trigger the fault, but unprivileged remote attackers appear unable to exploit this vulnerability based on the current description.