The vulnerability is an out‑of‑bounds read within the Windows Local Security Authority Subsystem Service (LSASS). Exploitation of this flaw allows an attacker to trigger a denial of service condition via network requests. The flaw causes LSASS to crash, removing authentication services and disabling user login until a system restart occurs, affecting availability for all users.

The flaw affects Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1) and Windows Server (2016, 2019, 2022, 2025), including the Server Core installations, as enumerated by the CNA.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of 1% indicates a low but non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker who is authorized—meaning they have credentials that permit interaction with the system—can trigger the denial of service by sending a crafted network request that causes an out‑of‑bounds read in LSASS, which crashes the service and disables authentication. Based on the description, it is inferred that the attacker needs the ability to send requests to LSASS, implying local or system‑level access through the network; remote exploitation without local privileges is not documented.