An integer overflow or wraparound condition in Windows Internet (wininet.dll) permits an authorized local attacker to gain elevated privileges. The flaw allows the attacker to manipulate internal counters or buffer sizes, leading to privileged code execution within the Windows environment. This vulnerability falls under CWE-190, Integer Overflow, and CWE-416, Use After Free.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1; Microsoft Windows Server 2012 R2, 2016, 2019, 2022, 2025 (including Server Core installations).

The CVSS score of 7.8 indicates a high severity, while the EPSS score is not available, suggesting limited current exploitation data, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an authorized attacker who can interact with wininet.dll through an application or script. If exploited, the attacker could raise the process token to SYSTEM level, compromising confidentiality, integrity, and availability of the affected system.