The vulnerability is a heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver. It is exploitable by an authorized local attacker and can be used to elevate privileges on the compromised machine. The flaw (CWE-122) may allow arbitrary code execution with higher privileges, compromising confidentiality, integrity, and availability of the affected system.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1 (also ARM64-based 26H2); and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including core installations).

The CVSS score of 7 indicates a high severity, yet no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a privileged local user; the attack vector is therefore local, and success depends on the attacker having sufficient local access to perform actions that trigger the buffer overflow.