An integer overflow or wraparound flaw in the Microsoft Streaming Service driver allows a local authorized user to elevate privileges. The vulnerability originates in the kernel streaming service, where improper handling of user-provided data leads to a 32‑bit counter wraparound that can be exploited to gain higher local privileges. The result is that an attacker can run code with elevated system privileges, bypassing normal access controls and potentially modifying system configuration or installing malware.

The flaw affects Windows operating systems including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both generic and Server Core installations). All affected systems use the Microsoft Streaming Service kernel driver for audio/video streaming.

With a CVSS score of 7.8, this issue is classified as high severity. The exploit is local, requiring that the attacker has already authenticated on the system or has legitimate user privileges. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting lower observed exploitation in the wild so far. However, the local nature and high privilege outcome mean that an attacker who can compromise a user session can elevate without any network exposure.