The vulnerability is a heap‑based buffer overflow in the Windows Update process. A local attacker with authorized access can cause the memory corruption to occur during an update operation, allowing the attacker to execute code with elevated privileges. Because the flaw resides in Windows Update, it is a privilege‑escalation flaw (CWE‑122) that can lead to full system compromise if the attacker runs beyond the user context.

Affected products include Microsoft Windows 10 for versions 1607, 1809, 21H2, and 22H2, Windows 11 for versions 23H2, 24H2, 25H2, 26H2, and 26H1 (and 23H2), as well as Windows Server 2016, Server 2019, Server 2022, and Server 2025 in both full and Server Core installations.

The CVSS score of 7.8 indicates a high severity for a local privilege escalation. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploits yet. The likely attack vector is a local, authenticated user executing the Windows Update service; therefore, the vulnerability is exploitable only in environments where the user has permission to perform system updates or has access to an affected system.