A heap-based buffer overflow in the Remote Access Point-to-Point Protocol (PPP) EAP‑TLS component allows an unauthorized attacker to execute code on the target machine. The vulnerability is a heap-based buffer overflow (CWE‑122) and its exploitation would enable full control of the compromised system, leaking or modifying confidential data and potentially allowing further lateral movement in a network. The description makes clear the primary impact is remote code execution over a network connection.

The vulnerability affects Microsoft Windows 10 and 11 releases from 1607 through 26H2, as well as Windows Server 2012 through 2025, including both server core and full installations. All listed operating system versions that support PPP EAP‑TLS are susceptible, covering a broad range of desktop and server environments.

The CVSS score of 9.8 marks this flaw as critical. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. This suggests no widespread exploitation, but the potential for remote code execution over a network means the risk remains high. The likely attack vector is over an authenticated or unauthenticated network connection that utilizes PPP EAP‑TLS, and conditions for exploitation include the presence of the vulnerable implementation and a remote attacker’s ability to send crafted data across the communication channel.