The vulnerability is a stack-based buffer overflow that occurs within the Windows TCP/IP stack. An authorized local attacker who can provide crafted network traffic to the system can trigger the overflow, allowing the attacker to gain higher privileges than the user account from which the exploit is executed. The weakness arises from improper bounds checking, which is classified as CWE‑121, and could enable the attacker to escape an unprivileged context to gain system level access, amplifying the potential for further compromise.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; Windows Server 2016, 2019, 2022, 2025, and 23H2 editions, including Server Core installations.

The CVSS score of 7.8 indicates a high severity local exploit. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV, the current exploitation landscape is uncertain; however, the local nature of the attack means that any user with network access to the target can potentially trigger the overflow. The lack of a publicly disclosed exploit does not diminish the risk, as the flaw can be leveraged by an attacker who can control network input and has sufficient privileges to run code locally.