This flaw is an integer underflow (wrap) that resides in the Windows WLAN Service. The underflow can be triggered by an attacker to cause the service to hang or crash, leading to a loss of wireless connectivity for the affected system. Because the vulnerable code is only exercised when the service receives particular network traffic, the impact is limited to the availability of WLAN‑related functions and any network authentication or file‑sharing services that depend on that connectivity.

Microsoft Windows 11 releases 23H2, 24H2, 25H2, 26H2, 26H1 and Windows Server 2025, including the Server Core installation. All affected versions run on x64 or arm64 processors as documented by the associated CPE strings.

The CVSS score of 7.5 places this deficiency in the high severity range, and the EPSS score of 1% indicates a very low but non‑zero probability of exploitation; it is not listed in the CISA KEV catalog. The likely attack vector is a remote network‑based payload sent over the wireless interface, meaning an attacker does not require local privilege or local network access to trigger the denial of service. The attack can isolate a system’s ability to associate with wireless networks and disrupt any services that rely on that connectivity until the offending packet flow stops or a patch is applied.