The vulnerability is a null pointer dereference in the Windows Message Queuing Queue Manager. When triggered, the Queue Manager process terminates, causing the messaging service to stop and potentially disrupting dependent network communications. Attackers who can reach the Queue Manager over the network and have authorized access can repeatedly send crafted requests to generate these crashes.

Affected products include Microsoft Windows 10 from build 1607 through 22H2, Windows 11 from build 23H2 through 26H2, and Windows Server editions from 2012 to 2025, including both standard and Core installations. All listed builds that contain the Message Queuing service are impacted.

The CVSS base score is 6.5, classifying it as medium severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, so the current likelihood of exploitation is unclear. The attack path requires network access and an authenticated account, meaning an insider or compromised credential could more readily exploit the flaw. Until a patch is applied, the risk should be treated as moderate.