An out‑of‑bounds read in Windows Active Directory Domain Services permits an authorized attacker to create a denial‑of‑service condition that can be triggered across the network. The flaw arises when the AD DS component processes improperly bounded memory, causing the service to crash or become unresponsive. Because the error is read‑only, confidentiality or integrity are not directly compromised, but the availability impact is significant for domain controllers and dependent services.

The vulnerability affects Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server releases from 2012 through 2025, including core installations.

With a CVSS score of 6.5, the risk is moderate. As of the updated data, the EPSS score is 1%, indicating a very low but non‑zero exploitation probability and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The attacker must have authorized access to the domain or privileged user rights. Once exploitation occurs, the domain services can become unavailable to all users, potentially causing widespread disruption.