The vulnerability is a heap‑based buffer overflow in the Windows kernel that allows a local attacker with non‑administrator privileges to corrupt kernel memory. By carefully constructing a payload the attacker can receive elevated rights, effectively turning a normal user into an administrator or system process. This compromise can expose confidential data, allow modification of critical system components, and disrupt system availability by granting unrestricted control over the operating environment.

Affected products include several Windows 10 versions (18 09, 21 H2, 22 H2), multiple Windows 11 releases (23 H2, 24 H2, 25 H2, 26 H2, 23 H2 again, 26 H1), and Windows Server releases 2019, 2022, and 2025; all standard and server‑core installations on x86, x64, and arm64 architectures are impacted.

The CVSS base score of 7.8 places this issue in the high severity range, while the EPSS score is not available, indicating limited data on current exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed yet. The likely attack vector is a local, authenticated user executing specially crafted code, because the flaw requires local privileges and does not provide a remote access path. Once the buffer overrun is triggered, arbitrary kernel code execution can occur, enabling direct privilege escalation.