The vulnerability is a heap-based buffer overflow in the Windows kernel32.dll component, allowing an attacker with local code execution privileges to elevate their privileges on the host. The overflow occurs due to missing bounds checking before a heap operation, which is a classic instance of CWE-122. This flaw permits the attacker to gain higher privileges locally, potentially leading to unauthorized access to protected system resources and the execution of arbitrary code at an elevated level. The likely attack vector is local code execution on the affected machine, inferred from the description that the attacker must already run code with local privileges.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 in both full and Server Core installations. These operating systems span x86, x64, and ARM64 architectures as reflected in the CPE data.

With a CVSS score of 7.8 the flaw is classified as high severity. An EPSS score is not publicly available, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation to date. The risk is limited to at most the affected host because exploitation requires prior local code execution. However, once local privileges are elevated, the attacker can carry out further actions such as persistence, lateral movement, or data exfiltration.