Heap-based buffer overflow in Windows Remote Desktop Services enables an authorized attacker to gain higher privileges on the same machine. The flaw falls under CWE-122 and allows a local privilege escalation when the attacker has authenticated access to the service.

The vulnerable software is Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 as well as Windows 11 versions 23H2, 24H2, 25H2, 26H1. Server variants include Windows Server 2012 (full and Core), 2012 R2 (full and Core), 2016, 2019 (full and Core), 2022, and 2025 (full and Core).

The CVSS score of 7.8 indicates a high severity of the vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires an authenticated session to Remote Desktop Services, implying that an attacker who can log in to the target system would be able to exploit the heap overflow to elevate privileges. Since the flaw acts locally and no exploit probability data is provided, the immediate risk is that any user with remote or local Windows credentials could exploit the service to acquire elevated privileges on that host.