A vulnerable memory allocation routine in Active Directory Federation Services allows an attacker to control the size value used during allocation. When the size exceeds acceptable limits, the AD FS service can become unresponsive or crash, effectively denying legitimate traffic to the federation endpoint. This flaw does not compromise confidentiality or integrity directly; its primary consequence is loss of availability for authentication and authorization traffic that relies on AD FS.

Microsoft Windows 10 version 1607 and 1809, Microsoft Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. The impact spans both full‑install and Server Core deployments for each of these operating systems.

The CVSS score of 7.5 rates the vulnerability as high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting the exploit risk is moderate but still present in environments that expose AD FS to the network. Attackers would need network access to the AD FS endpoint and can send a crafted request that triggers the out‑of‑bounds allocation, causing a denial of service without requiring any privileged state.