A heap-based buffer overflow in the Windows Win32 Kernel Subsystem (Win32k) allows an attacker who already has local access to execute code with higher privileges. The vulnerability is a classic out‑of‑bounds write that can be triggered by crafted input, granting the attacker full control over the machine when successfully exploited. The weakness is catalogued as CWE‑122 and scored with a CVSS of 7.8, indicating a high impact if leveraged.

The flaw affects multiple Microsoft Windows products, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2 through 26H2 and 26H1; as well as Windows Server 2012 through 2025, both standard and Core installations. All listed releases are impacted and require remediation.

The CVSS score of 7.8 reflects a significant threat. EPSS data is not available, and the vulnerability is not yet listed in CISA KEV, suggesting no publicly confirmed exploit at the time of analysis. Exploitation requires local, authorized access and the ability to supply crafted input to the kernel subsystem; remote exploitation is not supported by the description. The risk is therefore moderate to high for environments where privileged users may run untrusted code or where administrative accounts are present.