The vulnerability is a heap-based buffer overflow in the Windows Common Log File System Driver that permits a local attacker with sufficient access rights to gain elevated privileges. As a result, the attacker can execute code or alter system configuration with higher privileges, potentially compromising confidentiality, integrity, and availability of the affected system. This overflow can be triggered by manipulating log data that the driver processes, leading to an out‑of‑bounds write that results in unauthorized memory access or privilege escalation.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025, and 23H2 Edition. All vulnerable releases are those that ship the pre‑update Common Log File System Driver without the fix.

Based on the description, the likely attack vector is local and requires an authorized user or privileged process to trigger the buffer overflow. The CVSS score of 7.8 indicates high severity, while the EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in CISA KEV, implying no documented public exploitation as of the latest data. The local privilege escalation risk is restricted to users with existing local access.