A heap‑based buffer overflow in the Windows Storage subsystem enables a local, authorized attacker to elevate privileges on the infected system; the flaw, classified as CWE‑122, can be exploited to gain higher rights on the same machine, potentially allowing the attacker to execute arbitrary code with system privileges.

Affected releases include Microsoft Windows 11 v23H2, v24H2, v25H2, v26H1, v26H2, as well as Microsoft Windows Server 2022 and Windows Server 2025 (including Server Core installations).

The vulnerability carries a CVSS score of 7, indicating a moderate to high severity, but no EPSS value is available and it is not listed in the CISA KEV catalog, suggesting limited public exploit evidence. The attack vector is local; an authorized user or process that interacts with Windows Storage can trigger the overflow, thus a local attacker with sufficient access can leverage the flaw to elevate privileges. Given the moderate‑high impact and lack of publicly confirmed exploits, the risk remains significant for environments that have not yet applied the latest security updates.