The vulnerability is a heap-based buffer overflow in the Windows Update Service that can be triggered by any authorized local user. The exploitation can lead to privilege escalation, allowing the attacker to run with higher privileges than originally granted.

The affected products are Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1 including arm64 variants; and Windows Server 2016, 2019, 2022, and 2025, including Server Core installations. The vulnerability impacts both x86 and x64 architectures as indicated by the CPE entries.

The CVSS score of 7 indicates moderate‑to‑high severity. EPSS is not available, so the precise exploitation probability is unknown; the flaw is not listed in the CISA KEV catalog. The attack vector is local; an attacker must have an account on the affected machine to exploit the overflow and obtain elevated privileges. No publicly documented exploit is known at this time.