This vulnerability is a heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver that can be triggered by a locally authenticated user supplying crafted input. An attacker who is authorized to use Cloud Files can manipulate the buffer, obtain elevated SYSTEM privileges, and thereby run arbitrary code with full system rights. The weakness is classified as CWE‑822.

Affected platforms include Windows 10 build releases 1607, 1809, 21H2, and 22H2, as well as Windows 11 releases 22H3 and 23H2; all Windows Server editions from 2008 R2 SP1 and 2008 SP2 through to Windows Server 2022 are impacted. Both 32‑bit and 64‑bit architectures, along with ARM64 configurations where applicable, run the vulnerable mini filter driver.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low current probability of exploitation. The vulnerability is not in CISA’s KEV catalog, meaning no publicly known exploits are confirmed. Likely attack vectors are local, requiring an authenticated user who has permission to interact with Cloud Files or the mini filter driver; disabling the driver or restricting access can mitigate the threat.