The vulnerability is an out‑of‑bounds write in Windows Active Directory Domain Services that permit an authorized attacker to run arbitrary code over the network. This weakness enables privilege escalation within the domain, potentially giving the attacker full control of domain controllers and all client machines. The flaw is tied to CWE‑787, an improper bounds checking vulnerability with high exploitation potential once reachability to the vulnerable service is achieved.

Affected are Windows 10 builds 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, along with all Windows Server releases from 2012 through 2025, including their Server Core installations. The flaw exists in the native Active Directory Domain Services component of each of these operating systems.

The CVSS score of 8.8 indicates high severity, while the EPSS score is not available, making the current exploitation probability unclear, but the vulnerability is not yet listed in the CISA KEV catalog. It is likely that exposure can occur from any remote host connected to the AD traffic path, and the attacker would need legitimate credentials with domain access or delegated rights, implying the risk is focused on compromised or over‑privileged accounts. The absence of a publicly disclosed exploit does not negate the risk; Microsoft’s advisory recommends prompt remediation.