A heap–based buffer overflow exists within Windows Key Guard that can be triggered by a user who already has local access to a system. When exploited, an attacker can cause an escalation of privileges, enabling them to perform actions that would normally require higher authority. This flaw is related to memory corruption weaknesses (CWE‑122) and improper privilege checks (CWE‑863). The description explicitly states the capability to elevate privileges locally and does not indicate remote triggering or denial of service effects.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H1, and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025 in both full and server core installations are affected. The list is derived from the CNA vendor/product entries and the CPE strings that match each release and architecture.

The CVSS score of 7.8 places this vulnerability in the high severity range. The EPSS score of less than 1% indicates that the likelihood of exploitation is low at present, and the vulnerability is not currently catalogued in CISA’s KEV list. However, because the flaw requires only local authorized access, any compromised user account can potentially leverage it to gain system‑wide privileges. The attack vector is local and does not require network exposure, and exploitation hinges on the presence of the insecure Windows Key Guard component and the attacker’s ability to trigger the heap corruption. Attack methodology would involve providing crafted input to the vulnerable component, though the exact trigger is not detailed in the description.