The flaw lies in the Windows Network Driver Interface Specification (NDIS) kernel driver, where the ndis.sys component does not validate buffer length before copying data into it. This missing check can lead to a buffer overflow that allows an attacker to gain higher privilege within the local system. The direct result is that a user with local execution privileges can elevate their rights to run processes with elevated privileges, compromising system integrity and confidentiality.

The vulnerability affects multiple Microsoft Windows releases, including Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1) on both x86 and arm64 platforms, and Windows Server editions from Server 2012 through Server 2025 in both full and core installations. All affected configurations include the standard NDIS driver stack.

With a CVSS score of 8.8 the risk is high, yet the attack is local and requires a malicious application to be executed on the target. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. However, the high severity combined with local privilege escalation potential makes timely remediation a priority for organizations that run the affected Windows or Server releases.