A heap-based buffer overflow exists in the Network Policy Server component of Microsoft Windows. The flaw can be triggered by an attacker who has authorized access to the NPS service over a network, allowing that attacker to inject crafted data that overflows a heap buffer and overwrites executable memory. The result is arbitrary code execution with the privileges of the NPS service, which can compromise system confidentiality, integrity and availability. The vulnerability is classified as CWE-122.

The flaw affects Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1 and 23H2 (ARM64 and x64); and all Windows Server releases from 2012 through 2025, including core installations. Any system running the Network Policy Server role is potentially vulnerable.

The CVSS score of 7.5 indicates a high risk. No EPSS score is published, but the lack of a KEV listing does not reduce the likelihood of exploitation, particularly because the attacker needs only authorized access to the NPS service, which is common in many enterprise environments. The vulnerability is not exploitable remotely by unauthenticated users; it requires legitimate credentials or local network access to the NPS service. Nevertheless, it offers privileged code execution within the host, making it a serious threat when an attacker meets the access precondition.