A heap-based buffer overflow exists in the Microsoft Streaming Service driver that allows an authorized local attacker to gain elevated privileges. When triggered, the flaw can lead to the execution of arbitrary code with higher privileges, providing the attacker the ability to modify system configuration, install malicious software, or otherwise tamper with the system. The core weakness is a classic buffer overflow (CWE‑122).

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2) as well as Windows Server 2016, 2019, 2022, and 2025 are affected. Both 32‑bit and 64‑bit builds are included, and ARM64 devices running Windows 11 26H2 are also impacted.

The CVSS score is 7, indicating a moderate severity local privilege escalation. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation at present. Nevertheless, the flaw requires only an authorized local user context to trigger, making it a significant risk for internal or compromised accounts. The attack vector is inferred to be local, as the description indicates elevation for an authorized attacker.