A use‑after‑free flaw in Windows Secure Socket Tunneling Protocol (SSTP) allows an attacker to cause arbitrary code execution via a network connection. The vulnerability is classified as CWE‑416 and can lead to full compromise of the affected system, granting an attacker control over the compromised machine.

The flaw affects multiple Microsoft Windows operating systems. Specifically, all listed builds of Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and the Server family (Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025) including Server Core editions. All affected versions are mentioned in the Microsoft security advisory.

The vulnerability has a CVSS score of 9.8, indicating very high severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is network‑based, targeting the SSTP service exposed over the network. The description notes that an unauthorized attacker can exploit the flaw, implying that the attacker does not need elevated privileges on the target.