An out‑of‑bounds read bug in the Active Directory Domain Services component allows an unauthorized attacker to send crafted requests that cause the service to crash or become unresponsive, effectively disabling domain controller functionality for clients on the network. The flaw is a classic Improper Memory Management weakness (CWE‑125) that exploits a buffer that is read beyond its bounds during active directory processing.

Affected systems include a broad range of Microsoft Windows operating systems: Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23 H2, 24 H2, 25 H2, 26 H2, and 26 H1; and Windows Server spinoffs such as 2012 R2, 2016, 2019, 2022, and the forthcoming 2025, including both standard and Server Core installations.

The CVSS score of 7.5 indicates a high threat level for availability, with the EPSS score of 1% and the vulnerability not listed in CISA’s KEV catalog. The bug can be triggered remotely over a network by an attacker who can craft requests to the Active Directory service without authenticating. Successful exploitation would result in a denial of service that impacts all clients reliant on the affected domain controller.