A use‑after‑free flaw in the Windows Failover Cluster component allows an attacker to execute arbitrary code. An attacker who can reach the cluster’s RPC interfaces over a network can trigger the vulnerability, resulting in uncontrolled data loss, modification, and system takeover. The weakness is mapped to CWE‑416, underscoring the risk of using a dangling pointer to run malicious code.

Microsoft Windows 10 version 1809, Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core) are affected when the Failover Cluster service is enabled. All installations of these operating systems that provide the default cluster functionality remain vulnerable.

The CVSS score of 9.8 indicates a high severity threat. Since no EPSS estimate is available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of exploitation cannot be quantified, but the lack of public exploits does not diminish the theoretical risk of an attacker leveraging the flaw. Remote exploitation requires network access to the cluster’s RPC endpoints and the ability to send crafted requests.