A heap‑based buffer overflow in Windows Distributed File System (DFS) allows an attacker who has authorized credentials on the host to trigger memory corruption by sending specially crafted data. The flaw can lead to arbitrary code execution, providing the attacker full control of the system with the privileges of the DFS process.

The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server 2012 through 2025, including core installations. All releases listed by Microsoft in the CVE entry contain the vulnerable DFS component.

The CVSS score of 7.2 indicates a moderate to high risk. No EPSS score is available, so the likelihood of exploitation is unknown. The vulnerability is not in the CISA KEV catalog, suggesting no widely known exploitation. The attack vector is over the network using DFS protocols, and an attacker must have authorized access on the target machine to deliver the malicious payload.