The vulnerability is an out-of-bounds write in the Windows Local Security Authority Subsystem Service (LSASS). This flaw permits an unauthorized attacker to execute arbitrary code on the affected machine, compromising confidentiality, integrity, and availability. The flaw originates from insufficient bounds checking in the LSASS component, categorized under CWE-787, and would allow an attacker to gain full control of the target system.

Affected by Microsoft. The vulnerability impacts Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2019, Server 2022, and Server 2025, including Server Core installations. All x86, x64, and ARM64 architectures are affected as indicated by the CPE set.

The CVSS base score is 9.8, indicating Critical severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation yet. The exploitation path requires a remote attacker sending crafted requests to LSASS over the network; the likely attack vector is inferred as remote network interaction. Given the critical score and the fact that non‑privileged users can trigger the flaw, the risk is high and immediate attention is required.