The updated description identifies a heap-based buffer overflow in the Windows DWM Core Library that permits an authorized local attacker to elevate privileges. The flaw is a classic out‑of‑bounds write (CWE‑122) that corrupts heap metadata, an out‑of‑bounds read (CWE‑125), and a use‑after‑free (CWE‑416). When the component processes malicious data, these weaknesses allow the attacker to overwrite control information and execute higher‑privilege code, thereby compromising system integrity. The vulnerability is limited to Windows 11 version 26H1.

The affected product is Microsoft Windows 11 version 26H1 running on x64 and arm64 architectures. Only systems that include the unpatched DWM core component are vulnerable; all other Windows releases were not explicitly listed in the CNA data.

The CVSS score of 7.8 designates high severity, indicating a significant potential impact if exploited. The EPSS score of <1% shows a very low probability of exploitation. The CVE is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. The updated description suggests that the vulnerability is exploitable through local user actions, with no remote attack vector documented. Consequently, the risk is significant for systems that allow local users to run arbitrary applications in an elevated context.