A heap-based buffer overflow exists in the Microsoft PostScript Printer Driver, allowing an unauthorized local attacker to elevate privileges. By triggering the overflow, the attacker can gain higher OS-level access, potentially leading to full system compromise or the ability to execute arbitrary code with elevated rights.

The vulnerability affects a broad range of Microsoft Windows products, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, covering both standard and core installations.

The CVSS score of 7.8 indicates a high severity for a local privilege escalation attack. Although EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, the attack surface remains local, implying that physical or local user access is required. The lack of a known network vector reduces remote exploitation risk but still warrants prompt remediation because the vulnerability could be leveraged by insiders or malicious software with local execution privileges.