The vulnerability is a heap‑based buffer overflow in Microsoft OpenSSH for Windows that permits an attacker to execute arbitrary code on the target machine. An unauthenticated remote user can exploit this flaw by sending specially crafted SSH traffic, potentially achieving full system compromise. The weakness is identified as CWE‑122, indicating a classic memory corruption exploit that can lead to remote code execution.

Affected operating systems include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H2; and Microsoft Windows Server 2019, 2022, and 2025, including their Server Core variants. Any system running the OpenSSH for Windows service on these platforms without the security update is vulnerable.

The CVSS base score of 8.8 denotes high severity, and the flaw can be triggered over an unauthenticated network connection, making it valuable to attackers. No EPSS score is available, but because the attack vector requires only network traffic, the likelihood of exploitation remains significant. The vulnerability is not yet listed in the CISA KEV catalog, yet it poses a serious risk to exposed OpenSSH services.