The vulnerability is a use‑after‑free flaw in the Windows Network Policy Server (NPS) component that allows a remote attacker to execute arbitrary code on the host system. An attacker who can send specially crafted requests to the NPS service can trigger the vulnerability and run code with the privileges of the running service. The nature of the flaw is a typical memory corruption issue (CWE‑416) and results in full remote code execution, potentially giving the attacker complete control over the affected machine.

The flaw affects Microsoft Windows 10 build 1607, 1809, 21H2, 22H2, Windows 11 builds 23H2, 24H2, 25H2, 26H2, 26H1, and a range of Windows Server editions including 2012, 2012 R2, 2016, 2019, 2022, and 2025. Any system running the Network Policy Server role or its equivalent service component and exposed to an adjacent network is vulnerable.

The CVSS score of 7.5 denotes high severity. The EPSS score is not available, so there is no published exploit probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote network connection to the NPS service, which an attacker can craft to trigger the use‑after‑free. The flaw permits code execution without requiring local privilege escalation or pre‑existing user authentication, suggesting that any user able to reach the NPS port on the target network could exploit it.