A heap-based buffer overflow exists in the Windows Core Messaging component, enabling an authorized local attacker to elevate their privileges on the affected system. The flaw falls under CWE-122 and can be leveraged to gain higher levels of access, potentially compromising data integrity and secrecy on the host machine.

Affected systems include various releases of Microsoft Windows 10 (Version 1607, 1809, 21H2, 22H2), Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 23H2 variant, 26H1), and Microsoft Windows Server 2016, 2019, 2022, and 2025 (including Server Core installations). All listed editions expose the vulnerability through the Core Messaging component.

With a CVSS score of 8.8, the vulnerability is high severity, though its EPSS score is not available and it is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker requiring authorized access can exploit the overflow to run arbitrary code at elevated privileges. Because the flaw requires local execution, the risk is confined to compromised or compromised accounts within the affected operating systems.