A heap-based buffer overflow exists in the Microsoft PostScript Printer Driver that allows an attacker with local access to elevate privileges. The flaw is a classic CWE‑122 condition, granting the attacker higher rights on the affected Windows systems. The impact is confined to the host machine, enabling the attacker to execute arbitrary code as an elevated user without requiring additional credentials.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. Specific build or hotfix information is not provided, so all minor releases of these OS versions are assumed vulnerable until a patch is applied.

The CVSS score of 7.8 indicates a high severity, while EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local; an attacker must have physical or remote local access to the machine. Successful exploitation would allow privilege escalation locally, enabling the attacker to perform actions with elevated rights but without compromising network-wide scope.