A heap-based buffer overflow in the UNC provider kernel driver of the Windows File Server allows an attacker who already has local access to elevate privileges. The overflow permits the attacker to overwrite kernel memory, potentially granting operating‑system level control. The vulnerability is classified as CWE‑122.

Microsoft Windows 11 versions 24H2, 25H2 and 26H1, and Microsoft Windows Server 2022 23H2 (Server Core installation) and Microsoft Windows Server 2025 (Server Core installation) are affected. The vulnerable builds include both x64 and ARM64 architectures. No specific 32‑bit versions are indicated.

The CVSS base score is 8.8, indicating high severity, while the EPSS score is below 1 %, suggesting low exploit likelihood. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the attacker must have local authenticated access to trigger the overflow and that remote exploitation is not possible. The kernel‑level nature of the flaw makes the impact severe if exploited.