A use‑after‑free bug in the Windows Secure Socket Tunneling Protocol implementation allows an unauthenticated network attacker to execute arbitrary code with system privileges. The flaw permits malicious actors to run code with local system rights, potentially compromising data, modifying configuration, or installing persistent malware. The vulnerability is mapped to CWE‑416, reflecting unsafe memory management that deletes an object before it is finished being used.

The flaw affects numerous Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, and a range of Windows Server editions from 2012 through 2025, including both full installations and Server Core variants.

With a CVSS score of 8.1, this vulnerability is considered high risk, though its public exploitation probability is not quantified. The likely attack vector is over a network using SSTP, which is often employed for VPN connections. Because the bug is remotely exploitable through SSTP without authentication, the risk of compromise is significant. The issue is not yet listed in CISA’s KEV catalog, indicating that large‑scale exploitation has not been observed to date, but the absence of a KEV listing does not lessen the need for prompt patching. Affected users should immediately update their systems or temporarily disable SSTP.