This vulnerability is a use‑after‑free flaw in the Windows Failover Cluster component. When an attacker can send crafted traffic, the flaw causes the cluster service to use a freed memory area, enabling arbitrary code execution on the target system. The primary impact is the ability to run code with the privileges of the cluster service, effectively granting full control over the infected Windows Server.

The flaw affects Microsoft Windows Server 2019, 2022, and 2025, including the Server Core installations, that have the Failover Cluster service enabled. Any node participating in a cluster is vulnerable, regardless of its role in the cluster topology.

The CVSS score of 9.8 marks this as a critical vulnerability. The EPSS score is below 1%, indicating a low current exploitation probability, and the flaw is not listed in the CISA KEV catalog, suggesting no publicly known in‑the‑wild exploits. Exploitation requires network connectivity to the cluster nodes and can be carried out remotely from any host that can reach the cluster service ports. Because the weakness is a classic use‑after‑free, preventing exploitation without a patch is effectively impossible.