This vulnerability is a heap-based buffer overflow in the Windows Telephony Service. An attacker who can exploit the overflow can gain elevated privileges on the affected system, allowing further exploitation such as installing software, modifying system settings or accessing sensitive data. The weakness is classified as CWE‑122 because the overflow occurs on the heap when processing untrusted input.

Affected machines include Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 22H3, 26H1. In addition, all mainstream Windows Server editions from 2012 to 2025—including core installations—are impacted.

The CVSS score of 8.8 signifies a high severity, while the EPSS score of less than 1 % indicates a low expected probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no mass exploitation is currently documented. Based on the description the likely attack vector is an unauthenticated attacker who can reach the Telephony Service over the local or adjacent network. Successful exploitation requires only the ability to trigger the buffer overflow, after which elevated privileges are granted to the attacker.