A heap‑based buffer overflow in Microsoft COM for Windows allows an attacker with local access to gain higher privileges. The weakness is a classic unbounded buffer copy (CWE‑122) that, if successfully exploited, would give the attacker the ability to execute code or modify system files with elevated rights. Such escalation can compromise confidentiality, integrity, and availability of the affected system, potentially allowing full control over the machine.

Affected are numerous Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, plus Windows Server releases from 2012 through 2025. The broad range of supported architectures is noted in the supplied CPE list, covering x86, x64, and ARM64 platforms.

With a CVSS score of 7.8 moderate to high, the vulnerability carries a significant risk of exploitation, especially for attackers who already have local user or administrative presence. The EPSS score is 0.00306 (<1%), indicating a very low probability of exploitation, but the absence of a KEV listing suggests no widespread, publicly known exploitation yet. The attack likely requires the attacker to trigger the buffer overflow locally, perhaps through a crafted COM registration or via an application that interfaces with COM objects. Since it is an elevation of privilege flaw, only local attackers can exploit it; remote exploitation is not feasible.