A heap‑based buffer overflow in Windows Distributed File System (DFS) allows an attacker with legitimate network access to execute arbitrary code on a DFS server. The flaw, classified as CWE‑122, occurs when unvalidated data is written into a heap buffer, enabling the attacker to take control of the DFS process. This can lead to compromise of confidentiality, integrity, and availability of the impacted system.

Affected systems include Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, covering both standard and core installations. The vulnerability is present on x86, x64, and arm64 architectures, affecting a broad range of desktop and server deployments.

The CVSS score of 8.8 indicates high severity. EPSS data is unavailable, so the likelihood of exploitation can’t be precisely quantified, and the vulnerability is not listed in the CISA KEV catalog, suggesting no documented public exploitation at this time. The attack requires the attacker to have network access to a DFS service and sufficient privileges to trigger the overflow, after which code can execute with the privileges of the DFS process.