A heap-based buffer overflow in the Windows Desktop Window Manager Core Library allows an attacker who already has local access to elevate privileges on the affected system. The flaw arises from improper bounds checking during memory handling, enabling the exploitation of a CWE-122 vulnerability to gain high privileges without external influence.

Affected products include Microsoft Windows 10 versions 1507, 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H2, 23H2, 24H2, and 25H2; and Windows Server releases 2016, 2019, 2022, and 2025 across both full and Server Core installations.

The CVSS score of 7.8 indicates a high severity local privilege escalation, while the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local execution by a user with legitimate access, who could trigger the overflow to seize higher system privileges.