The vulnerability is a heap-based buffer overflow in Windows Storage that allows an attacker with local authorized access to elevate privileges. By exploiting the overflow, a malicious process can overwrite critical data structures and gain higher privileges, potentially culminating in full system control. This type of flaw can compromise both confidentiality and integrity of the affected machine.

Affected systems include Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server 2022 and Windows Server 2025, encompassing both x64 and ARM64 architectures.

The CVSS score is 7, classifying the vulnerability as High. The EPSS score is not available and it is not listed in CISA's KEV catalog, suggesting limited known exploitation. The likely attack vector is local; an attacker must already be authenticated to the machine or have some level of authorized access. A local attacker could trigger the buffer overflow through a crafted input supplied to Windows Storage, thereby elevating their privileges.