The vulnerability stems from an integer overflow or wraparound in Windows Device Health Attestation (DHA), which permits an unauthorized attacker to execute code over a network. This flaw enables arbitrary code execution under the privileges of the DHA service and is rooted in classic weaknesses such as heap-based buffer overflow (CWE-122) or integer overflow (CWE-190).

This vulnerability applies to Microsoft Windows 10 version 1809 and the Windows Server family, including Windows Server 2019, Windows Server 2022, Windows Server 2025, and their Server Core installations. Systems that have the Device Health Attestation feature enabled are affected.

The CVSS score of 8.1 indicates high risk, while the EPSS score of less than 1% signals a currently low probability of exploitation. It is not listed in CISA’s KEV catalog, which suggests it has not yet been widely exploited in the wild. Based on the description, it is inferred that an attacker would need remote network access to a target running the affected DHA component, and the exploit would generally occur via a crafted request to the attestation service. Once triggered, arbitrary code can be executed with the privileges of the service process.