A heap-based buffer overflow in the Windows Mobile Broadband driver enables an unauthorized attacker with physical access to execute arbitrary code on the target system. The flaw allows the attacker to inject and run code, potentially escalating privileges and compromising confidentiality, integrity, and availability of the affected device. The vulnerability is a classic example of CWE‑122, where improper bounds checking leads to uncontrolled memory writes.

Microsoft Windows 10 Version 21H2 and Version 22H2 are affected, including all supported CPU architectures listed in the Common Platform Enumeration strings: x86, x64, and arm64. Users of these Windows 10 releases should verify whether their devices are running the vulnerable mobile broadband driver.

The CVSS score of 6.8 indicates a moderate to high severity, but the EPSS score of less than 1% means the probability of exploitation is low. The vulnerability is not listed in CISA’s KEV catalog, suggesting no documented public exploit at this time. The attack requires physical presence, limiting the practical risk to environments where an adversary can gain physical access. Nonetheless, the ability to execute arbitrary code presents a serious threat if the device is compromised.