A heap-based buffer overflow exists in the Windows Storage Spaces Controller that permits an unauthorized attacker to trigger a denial-of-service condition by sending crafted input over a network. The flaw is a classic CWE‑122 overflow that corrupts control data on the heap, leading the controller to crash or become unresponsive. With the service halted, systems that rely on Storage Spaces exhibit loss of storage availability, potentially affecting dependent applications and users. The reported CVSS score of 7.5 denotes a high severity, underscoring the potential for significant operational disruption.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (duplicate notation), 26H1; Microsoft Windows Server 2019 (including Server Core); Windows Server 2022; and Windows Server 2025 (including Server Core). The vulnerability is listed as affecting all the specified operating system releases without granular build or patch level distinctions.

The CVSS score of 7.5 indicates that the vulnerability is moderately to highly exploitative, and the EPSS score of 1% indicates a low but nonzero probability of exploitation. The lack of KEV listing suggests no current known widespread use. Attackers would need network access to the affected machine, and by sending malicious requests to the Storage Spaces Controller can force a crash, resulting in a denial of service. No official CNA patch or workaround is referenced in the advisory, implying that remediation typically involves applying the latest cumulative update that includes the fix, or otherwise restricting network access to the vulnerable service.