An integer underflow in Microsoft’s Network Policy Server can be exploited by an unauthorized attacker to execute arbitrary code over the network. The flaw involves a wrap‑around condition that leads to a stack corruption, which is a classic stack‑based buffer overflow. If successfully triggered, the attacker can run code with the privileges of the NPS process, potentially compromising the entire host.

The affected systems include Microsoft Windows 10 (v1607, v1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. All of these operating system versions contain the Network Policy Server component that is vulnerable.

The CVSS score of 9.8 classifies this as Critical. The EPSS score is <1%, indicating a very low but nonzero exploitation probability; the lack of listing in CISA KEV does not diminish the severity. Based on the description, it is inferred that an attacker could send crafted input to the NPS service, which listens on a well‑known port, to trigger the underflow and obtain code execution.