An out‑of‑band use‑after‑free flaw in Microsoft’s OpenSSH for Windows lets an unauthenticated network attacker execute arbitrary code. The vulnerability allows code to run with the privileges of the OpenSSH process, potentially giving the attacker control over the host. This can lead to compromise of confidentiality, integrity, and availability.

Microsoft Windows 10 (versions 1809, 21H2, and 22H2) and Windows 11 (versions 23H2, 24H2, 25H2, 26H2, and 26H1) as well as Microsoft Windows Server 2019, 2022, and 2025 are affected when the OpenSSH for Windows component is installed and exposed to the network. Systems running these Windows releases with the OpenSSH service enabled are susceptible.

The CVSS score of 9.8 classifies the flaw as critical. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, suggesting no known active exploits yet. Attackers can exploit the vulnerability remotely over the network by targeting the OpenSSH service, assuming it is listening on standard ports. The use‑after‑free condition can be triggered through crafted input sent to the server, allowing code execution without authentication.