A heap-based buffer overflow in the Microsoft Streaming Service driver can be triggered by an attacker who has local authorization. Exploiting the overflow allows the attacker to write arbitrary data to memory, potentially injecting malicious code that escalates the attacker’s privileges to a higher local level. The weakness maps to CWE-122 (heap-based buffer overflow) and CWE-190 (integer overflow or underflow). The impact is a compromise of the local system’s integrity and confidentiality, leading to full control over the affected machine.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows 11 for Arm 64‑based systems version 26H2; Microsoft Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, and Server 2025, including Server Core installations; and Windows Server 2025 core installation. All these editions of Windows and Windows Server are impacted according to CNA documentation.

The vulnerability carries a CVSS score of 7.8, indicating high severity. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no current widespread exploitation. The likely attack vector is local, requiring the attacker to have legitimate access to the system. Once the heap overflow is triggered, the exploit can elevate privileges, potentially allowing the attacker to perform any action permitted to a fully privileged user. The absence of public exploit references or a KEV listing does not diminish the risk for systems that have not been patched, especially given the high CVSS score.