A heap‑based buffer overflow in Windows Object Linking and Embedding (OLE) can be triggered by a user who has authorization to execute OLE COM objects. An attacker can exploit the overflow to gain higher privileges on the local machine, potentially enabling system‑wide impact if executed with elevated privileges. The weakness is a classic out‑of‑bounds write (CWE‑122).

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Microsoft Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, Server 2025, including Server Core installations for Server 2012, Server 2012 R2 Server 2016, Server 2019, and Server 2025. All mentioned editions and processor types are implicated.

The CVSS score of 7.8 indicates high severity, but the EPSS score indicates a very low probability of exploitation (<1%), and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local execution of malicious OLE code by a user who already has rights to run such code, meaning that unauthorized remote exploitation is not the primary concern.