The vulnerability is an out‑of‑bounds read in the Windows Key Distribution Center (KDC) component. A malicious actor can trigger this read by sending a specially crafted request over a network, causing the KDC service to terminate and denying authentication for the host. The weakness falls under CWE‑125, indicating that a memory read occurs beyond a buffer’s bounds, a serious error that can collapse the authentication infrastructure. Because the KDC is essential for domain logon, any crash directly disrupts user and service access to network resources.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 in both full and Server Core installations. These products expose the vulnerable KDC implementation and are therefore susceptible.

The CVSS score of 7.5 denotes high severity, and because the exploit is network‑based and requires no special privileges, any machine that can reach the KDC port is a potential target. The EPSS score is not available, limiting our view of current exploitation trends; however, the lack of an EPSS rating does not reduce the seriousness of an unchecked KDC crash. The vulnerability is not listed in the CISA KEV catalog, but the fact remains that unpatched domain controllers can suffer from widespread denial of service during authentication attempts. The likely attack vector is therefore over the network, with an attacker sending crafted packets to the KDC service to induce the crash.