The vulnerability is an uncontrolled resource exhaustion in the RPC Endpoint Mapper Service, which allows an unauthorized attacker to consume system resources and disrupt service availability. It is identified as a denial‑of‑service weakness (CWE-770). The flaw permits an adversary to trigger excessive allocation of memory or processing, causing the service to become unresponsive or crash.

Affected are multiple Microsoft Windows client and server releases. On Windows clients, versions include Windows 10 from build 1607 up through 22H2, and Windows 11 from the 23H2, 24H2, 25H2, 26H2 releases as well as 26H1. On Windows Server, the flaw exists in 2012, 2012 R2, 2016, 2019, 2022, and 2025, including server core installations of the 2012 and 2012 R2 editions.

The CVSS score of 5.9 places the vulnerability in the medium severity range. EPSS is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit the flaw remotely over a network; any host capable of communicating with the RPC Endpoint Mapper Service can issue the crafted request. This enables a distributed denial‑of‑service attack against the targeted machine, potentially affecting network service provision.