A use‑after‑free flaw in Windows Distributed File System (DFS) permits an attacker with authorized credentials to execute arbitrary code over a network. The vulnerability allows remote code execution, potentially letting the attacker gain control of the DFS host or client with the privileges of the DFS process. This can compromise the entire system and any connected resources.

The flaw affects a broad set of Microsoft Windows products, including Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1) and Windows Server from 2012 to 2025, including Server Core installations where applicable. Any machine that runs the DFS role or is a client connecting to DFS namespaces is subject to the impact.

The CVSS score of 7.5 indicates a high risk level. The EPSS score is < 1%, suggesting a low probability of exploitation in current conditions, and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to have valid credentials and network access to a DFS host or client, implying that only authorized or privileged users can trigger the flaw. Once executed, the attacker can run arbitrary code with the privileges granted to the DFS service, resulting in a compromise of confidentiality, integrity, and availability for the affected systems.