A use‑after‑free flaw discovered in the Windows Network Policy Server component permits an unauthenticated network attacker to trigger code execution. When a privileged operation involving shared memory is improperly finalized, malicious data can be processed, leading to arbitrary code execution with the same privileges as the Network Policy Server service. This flaw satisfies the conditions for a remote code‑execution vulnerability, classified under CWE‑416.

The flaw affects Microsoft Windows 10 and 11 operating systems, specifically the 1607, 1809, 21H2, and 22H2 releases for 32‑bit and 64‑bit, as well as Windows 11 releases 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1. It also impacts Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 editions, including Core installations of each server version.

The vulnerability is rated high with a CVSS score of 8.1, but no EPSS score is available and the flaw is not listed in CISA KEV. The likely attack vector is remote, where an unauthenticated attacker sends specially crafted network traffic to the NPS service to exploit the use‑after‑free condition. Exploitation would grant the attacker code execution privileges on the affected system. Because the flaw is network exposed and requires no initial authentication, its potential impact is significant, warranting urgent remediation.