The flaw is a heap‑based buffer overflow in the HID class driver that permits a local attacker with authorized access to trigger the overflow and subsequently elevate privileges on the system. Because the overflow occurs in user‑space code that processes HID inputs, the exploit can bypass normal access checks and gain higher authority, potentially allowing execution of arbitrary code or installation of malware. The weakness is identified as CWE‑122, indicating untrusted data handling without proper bounds checking.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, the 23H2 and 26H1 variants, and Windows Server 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations) are affected. All those releases require the Microsoft security update documented at the provided msrc link.

The CVSS score of 7.8 marks the issue as a high‑severity privilege escalation problem. The EPSS score is not available, so current exploit probability cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits yet. Attackers must be local with legitimate user rights to interact with HID devices; the flaw therefore poses a significant risk in environments where untrusted hardware peripheral access is possible or where administrative privileges are granted to users that could abuse the HID driver. Prompt application of the vendor patch is the most effective mitigation.