The flaw is a stack-based buffer overflow that can be triggered by an authorized local attacker against the Azure Connected Machine Agent. Exploiting this overflow permits the attacker to overwrite control data on the stack and gain elevated privileges on the host, enabling any action normally restricted to higher-privileged accounts. The weakness is classified as CWE-121, which describes unprotected or inadequately protected buffer access that may lead to memory corruption.

The vulnerability affects Microsoft Azure Connected Machine Agent. No specific affected version range is listed, so all instances running a pre‑fix version remain vulnerable until a patch is applied.

With a CVSS score of 7.8, the incident poses high impact if exploited, yet the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not included in the CISA Known Exploited Vulnerabilities list, and no public exploit is known. The attack vector is inferred to be local, requiring the attacker to have some level of authorized access to execute code within the agent process and trigger the overflow.