An out‑of‑bounds write in the Windows Hotpatch Monitoring Service allows a local authorized user to execute code that can write data beyond allocated buffers. This memory corruption can overwrite sensitive service memory and elevate the attacker’s privileges. The weakness is identified as CWE‑787, leading to a local privilege escalation scenario in which a user with basic access can gain administrative rights.

Microsoft Windows 11 versions 24H2, 25H2, and 26H1, and Microsoft Windows Server 2025, including the Server Core installation. The affected builds are documented for both ARM64 (24H2 and 25H2) and x64 (26H1) architectures.

The CVSS score of 7.8 illustrates a moderate to high severity. The EPSS score is not available, providing no numeric exploitation probability; however, the lack of listing in the CISA KEV catalog suggests no known active exploitation campaigns yet. The vulnerability requires a local attacker with some level of system access to trigger the out‑of‑bounds write. Successful exploitation would allow the attacker to gain elevated privileges on the affected machine. While the exact likelihood of exploitation cannot be quantified, the potential impact warrants prompt attention.