The flaw arises from an out‑of‑bounds read in the Windows Server NFS driver; a specially crafted network packet can lead the driver to read memory beyond its bounds, allowing an attacker to execute arbitrary code without authentication. The flaw is classified as CWE‑125 and can compromise the confidentiality, integrity, and availability of the affected system.

The vulnerability impacts Microsoft Windows 10 version 1607 and 1809, Windows Server 2012 and 2012 R2, Windows Server 2016, 2019, 2022, and the forthcoming Windows Server 2025, on both full and Server Core installations, across both x86 and x64 architectures as identified by the listed CPE entries.

With a CVSS score of 8.8 the issue is high severity; EPSS data is not available and the flaw is not yet in the CISA KEV catalog. The attack vector is remote over the network, requiring no authentication, and when exploited it can achieve full code execution, making the risk significant until the vendor updates are applied.