An out-of-bounds read in a Windows Wi‑Fi driver lets an unauthorized attacker cause a denial of service on an adjacent network. The flaw is a classic buffer overread (CWE-125) that can crash the driver when processing crafted Wi‑Fi frames. The disruption affects network connectivity for devices using the vulnerable Windows OS, potentially isolating them from critical wireless services. The description indicates that no user interaction is required; an attacker with wireless access can exploit the weakness.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core variants. All builds listed in the CNA set are vulnerable until patched.

The CVSS score of 6.5 denotes a moderate severity. EPSS information is not available, so the current risk level cannot be quantified precisely; however, the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via the wireless medium, since the flaw is in the Wi‑Fi driver. An attacker who can transmit malicious frames on the attacker’s own network can potentially trigger the crash, leading to loss of connectivity for any adjacent Windows devices that process the traffic.