A heap-based buffer overflow in Windows NetBIOS permits an authorized local attacker to elevate privileges to an elevated local level. The flaw is a classic memory corruption bug, CWE-122, that can lead to full control over the affected computer, allowing the attacker to run arbitrary code with higher privileges.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations).

The CVSS score of 7.8 marks this as a high‑severity vulnerability, but the EPSS score is not available, so the likelihood of exploitation in the wild cannot be quantified. It is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker with legitimate local access can trigger the buffer overflow by interacting with the NetBIOS service. No specific remote exploitation path is documented in the provided information.