A heap-based buffer overflow within the Function Discovery Service DLL (fdwsd.dll) lets an attacker who already has local access upload code or otherwise manipulate the service. When the overflow is triggered, the service runs with elevated privileges, allowing the attacker to execute arbitrary code and gain administrative rights. This flaw is categorized as a classic buffer overflow vulnerability (CWE‑122).

Affected vendors/products include Microsoft Windows 10 from version 1607 through 22H2, Windows 11 from 23H2 through 26H1, and Windows Server editions from 2012 to 2025, including both standard and Server Core installations. All listed OS families host the fdwsd.dll component susceptible to the overflow.

The CVSS v3 score of 7 indicates a high severity vulnerability. EPSS data is not available, so the exploitation probability cannot be quantified. The flaw is not listed in CISA's KEV catalog, implying no known large-scale exploitation. Attackers must be authenticated or have local code execution before triggering the overflow; thus, remote exploitation is unlikely without user interaction or pre-existing local compromise. If an attacker can trigger the overflow, they can elevate privileges to SYSTEM or Administrator, leading to full control of that machine.