Heap‑based buffer overflow in the Windows DCOM Server can be triggered by an authenticated user who has local access to the machine. The flaw allows the attacker to write beyond the intended bounds of a heap buffer, which in turn lets the attacker gain higher privileges on that local system. The vulnerability is not exploitable from the network; only users who already can run code locally can abuse it to elevate their privileges and potentially gain administrative rights.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H1, as well as Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and Server Core installations) are affected. These include both legacy and current operating system iterations, covering a wide range of common desktop and server deployments.

The CVSS score of 7.8 indicates that the flaw poses a high risk when an attacker has local access, but the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation so far. The attack requires that the user be able to run code on the host and has access to the DCOM service. If an attacker can trigger the overflow, they can achieve local privilege escalation, potentially granting them full administrative control over the affected system. Organizations with unrestricted local accounts should treat this as a significant threat.