The vulnerability is a null pointer dereference within Microsoft’s Active Directory Domain Services component. Exploitation causes the Windows domain service to crash or become unresponsive, resulting in a denial of service against the domain controller network resource. The weakness is identified as CWE-476, indicating that a null pointer is dereferenced without proper validation, which can lead to a sudden service termination and disruption of any dependent authentication and directory lookup operations. This impact is limited to availability; confidentiality or integrity are not directly affected by the flaw as described.

Microsoft Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 Versions 23H2, 24H2, 25H2, 26H2, Windows 11 Version 23H2 (duplicate), Windows 11 Version 26H1, Windows Server 2022, Windows Server 2025 (including Server Core installations). These are the specific Windows operating system releases that host the vulnerable Active Directory Domain Services component.

The CVSS base score of 6.5 classifies the problem as a medium severity issue. The EPSS score is 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, indicating a lower prevalence of known exploitation. The likely attack vector is network-based, inferred from the fact that the flaw resides in domain services that accept connections over the network, but explicit details are not provided. An attacker must have authorized access to the domain controller or privileged local user rights to trigger the crash, reducing the risk of exploitation by an external adversary. Overall, the risk is moderate with a moderate likelihood of exploitation under the given conditions.