A heap-based buffer overflow exists in Windows Spaceport.sys that permits an authorized local attacker to execute code on the affected system. The flaw is classified as CWE-122, and exploitation can lead to arbitrary code execution at the level of the user that loaded the driver. Because the vulnerability requires a user already authenticated to the machine, it does not provide a traditional remote attack vector, but it can be used to elevate privileges if the attacker already enjoys local access.

The vulnerability affects Microsoft Windows 10 releases 1809, 21H2, and 22H2, along with Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2019, 2022, and 2025. The specific driver space for each version is detailed in the Microsoft security update guide.

The CVSS score of 7.8 indicates a high severity for local exploitation. EPSS data is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not known to be actively exploited in the wild. The likely attack path requires an attacker with local privileges to cause the overflow, meaning mitigations that limit local user privileges and device access can reduce risk. Nonetheless, applying the vendor patch is the most effective and recommended method to mitigate this risk.