KB5046617: Windows Server 2025 Security Update (November 2024)

An attacker who can persuade a KDC Proxy server to fetch a Kerberos response from a server they control — by hijacking DNS for the configured DC, MITM-ing the connection, or directly redirecting the proxy — can return a crafted response with oversized length values that triggers the integer overflow and lets them run code in the KPSSVC context. The result is unauthenticated remote code execution on the proxy, with SYSTEM privileges.

The Kerberos KDC Proxy Service (KPSSVC) lets remote clients perform Kerberos authentication over HTTPS, used by features like Always-On VPN, Direct Access, and Remote Desktop Gateway to give external clients access to AD authentication without exposing Kerberos on the internet. A numeric-truncation / integer-overflow flaw in how KPSSVC parses Kerberos responses lets an attacker who can lure the proxy into connecting to a malicious domain controller corrupt memory and execute code. Domain controllers themselves are NOT directly vulnerable.

Probably yes if any of these apply:

An organisation hosts a Windows Server in a DMZ as a Kerberos KDC Proxy to support Always-On VPN clients. An attacker compromises the network path between the proxy and the internal DC — for example by ARP-poisoning the proxy's VLAN. The attacker returns a crafted Kerberos response; the proxy parses it, overflows, and the attacker has SYSTEM on a DMZ server that has direct authenticated access into the AD environment.