Heap-based buffer overflow occurs in Microsoft Windows Media Foundation when an unauthorized local attacker supplies crafted input, causing corruption of heap memory. Based on the description, it is inferred that the overflow can overwrite critical heap data, enabling the attacker to gain higher privileges on the host system, as the description specifically states the vulnerability allows an attacker to elevate privileges locally.

Affected systems are Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both regular and Server Core installations.

The CVSS score of 7.8 indicates high severity. The EPSS score is not available, so the current exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The risk assessment is inferred from the described local privilege escalation and lack of a publicly known exploit. Based on the description, it is inferred that this elevation can compromise system integrity. Because the attack requires local access and exploitation of Media Foundation components, the risk is significant for systems that process untrusted media content. Prompt mitigation is advisable.