The vulnerability is a heap‑based buffer overflow (CWE‑122) in the Windows TCP/IP stack. When triggered, it allows an attacker who has authorized local access to overwrite control data and execute arbitrary code, effectively elevating a standard user to a fully privileged account and compromising the system’s integrity.

Microsoft Windows operating systems are affected, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 22H3; and a range of Windows Server releases from Server 2012 through Server 2025. Both standard and Server Core editions, as well as 32‑bit, 64‑bit, and ARM64 builds, are listed by Microsoft as vulnerable.

With a CVSS score of 7.8 the flaw is classified as high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, so the precise exploitation probability is unknown. The attack vector is inferred to involve a crafted network packet sent to the local system, although the official description does not detail the trigger; once triggered, an authorized local user can gain administrative privileges and full system control.