The vulnerability is a heap‑based buffer overflow in the Internet Connection Sharing component of Windows. An attacker who can send crafted input from a nearby network can cause the operating system to execute arbitrary code, giving the attacker the same privileges as the user running the affected service.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and multiple Windows Server releases – 2012, 2012 R2, 2016, 2019, 2022, and 2025 – including Server Core installations.

With a CVSS score of 7.1 the vulnerability is classified as high severity. The EPSS score is not available and the flaw is not listed in CISA KEV. The likely attack vector is an attacker with network access to the affected host, such as a device on the same LAN or an adjacent network segment. By sending malicious traffic to the Internet Connection Sharing service the attacker can trigger the heap overflow, overwrite function pointers, and execute code with system privileges, thereby compromising confidentiality, integrity, and availability of the compromised machine.