The flaw is an integer overflow or wraparound in the Windows IP Over USB Service that can be triggered by an authorized local user. When the service processes certain values, the arithmetic overflow allows the attacker to write beyond bounds and thereby gain higher privileges on the host. The weakness is identified as CWE-190 and results in local privilege escalation.

Microsoft Windows 10 versions 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1, as well as Windows Server 2022 and Server 2025 (including Server Core). These systems expose the Windows IP Over USB Service, which is the component vulnerable to the overflow.

The CVSS score of 7.8 classifies the vulnerability as high severity. No EPSS score is available and the vulnerability is not yet listed in CISA KEV, indicating limited threat intelligence data. Because the attack requires the user to be authorized on the machine, the likely attack vector is a local compromise or credential theft. Once the service is tricked into executing an overflown value, the attacker can elevate privileges and potentially take full control of the affected system.