A heap-based buffer overflow in the Windows Client License Service allows an authenticated local actor to raise privileges on the affected system. The flaw is tied to CWE‑122 and CWE‑197 and can be exploited to bypass local security controls, potentially giving the attacker full system authority. This elevation can lead to unauthorized data access, modification of system settings, and installation of persistent malware.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core) are impacted.

The CVSS score of 7 reflects high severity. Although the EPSS score is not available, the vulnerability has not been flagged in the CISA KEV catalog. The attack requires local, authenticated access, suggesting that a user with sufficient privileges could trigger the overflow. Given the high severity and the local nature of the exploit, the risk to systems that have not applied the patch is substantial.