A heap-based buffer overflow exists in the Windows Print Spooler Components. An attacker who is authenticated locally can trigger the overflow by submitting a crafted print job, allowing execution of arbitrary code with elevated local privileges. This flaw is identified as CWE‑122.

Affected systems include Microsoft Windows 10 21H2, 22H2, Windows 11 23H2, 24H2, 25H2, 26H1, as well as Windows Server 2022 and Windows Server 2025. The vulnerability applies to x86, x64 and arm64 processor architectures.

The CVSS score of 7.8 reflects a high severity for a local privilege escalation. The vulnerability is triggered when the Print Spooler service processes a crafted print job from an authenticated user. Local attackers can exploit the heap overflow to run code with elevated privileges, enabling full control over the system. The EPSS score is not available; the lack of a score does not diminish the risk. Remote attackers cannot exploit this flaw directly, as the required condition is local authentication. The vulnerability is not listed in the CISA KEV catalog.