The vulnerability is a heap-based buffer overflow located in the Windows kernel that allows a malicious local user to elevate privileges. The flaw permits the attacker to write past buffer bounds, corrupt kernel memory, and gain higher access rights. It is identified as a type of buffer overflow weakness (CWE‑122).

Affected Windows platforms include Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and core installations). Any operating system in this product range that has not yet been updated to the latest release contains the vulnerable kernel component.

The CVSS base score of 8.8 indicates a high severity level, while the EPSS score of less than 1 % suggests that exploit attempts are currently rare but not impossible. The vulnerability does not appear in the CISA KEV catalog, but a local, authorized attacker could leverage the heap overflow to obtain elevated rights, potentially compromising system integrity and confidentiality. Exploitation would require local execution privileges to trigger the buffer overflow and is likely most effective with an attacker‑supplied payload that targets the vulnerable kernel space.