A use-after-free flaw exists in Windows Network Load Balancing (NLB) that allows an unauthorized attacker to execute code over an adjacent network. The vulnerability is a classic memory-safety error that leads to remote code execution, representing a severe breach of confidentiality, integrity, and availability. The associated weakness is identified as CWE-416, which indicates that the flaw arises from dereferencing freed memory.

The vulnerability affects Microsoft Windows 10 version 1607 and 1809, Windows Server 2012 (including Server Core), Windows Server 2012 R2 (including Server Core), Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core). All listed OS releases are affected unless a specific update address the flaw.

The CVSS base score is 8.8, indicating high severity. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog, suggesting no documented exploitation yet. The likely attack vector requires an attacker to be able to reach the victim over a network and to send malformed packets to the NLB service; no special privileges are needed on the host.