An integer overflow or wraparound bug occurs in the Windows Terminal component, allowing an attacker with the ability to supply malformed input to execute code within the user’s terminal process. The bug is a heap-based buffer overflow associated with CWE‑122 and an integer overflow identified as CWE‑190. The resulting corruption can give the attacker control of execution flow. Because the code runs in the context of the terminal, the impact may extend to elevated privileges or compromise of data accessible to that session. The vulnerability is documented as local code execution, even though the CVE title suggests remote implications; the impact does not explicitly state remote exploitation potential. Based on the description, it is inferred that the attacker must be able to inject malformed data into a running Terminal instance, typically requiring local access or the ability to run code within an active user session. The likely attack vector therefore involves a local or user‑session‑level attacker supplying crafted input that triggers the overflow. In risk terms, the CVSS score of 7.8 classifies the vulnerability as high severity. However, the EPSS score of less than 1% indicates that exploitation in the wild is currently unlikely, and the flaw is not listed in CISA’s KEV catalog, implying no known widespread exploitation. If exploited, the attacker would gain the privileges of the terminal process, potentially enabling privilege escalation or system compromise if higher privileges are attainable.

Microsoft Windows 10 versions 21H2 and 22H2, Microsoft Windows 11 versions 24H2, 25H2, and 26H1, Microsoft Windows Server 2022 and Server 2025 (including Server Core installations), and the Windows Terminal apps that ship with Windows 10 and Windows 11. All unpatched installations of these operating systems and Terminal versions are susceptible.

The high CVSS score underscores the seriousness of the flaw, but the very low EPSS score indicates that an attacker is unlikely to find a viable environment to exploit it at present. The vulnerability can only be leveraged by a local attacker who can supply the crafted input to a Window Terminal session, meaning that compromising an active user account or code execution within a session is a prerequisite. No evidence of widespread exploitation exists, and the issue is not included in CISA’s KEV catalog, further reducing the immediate threat level. Nonetheless, if the vulnerability were to be exploited, it would confer local code‑execution rights which could be used to elevate privileges or persist on the system.