The vulnerability is a heap-based buffer overflow in the Windows Portable Device File System Driver. This flaw enables an attacker with local authorization to gain elevated privileges, potentially reaching SYSTEM level. As a result, the attacker could fully compromise the affected host, exposing data, altering system state, or disrupting availability. The weakness is classified as CWE-122.

The flaw affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2 through 26H2 and 26H1; as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their server core installations. Both x86 and x64 architectures are impacted across the listed releases.

The CVSS score of 7.8 indicates a moderate to high severity. The EPSS score is missing, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting no publicly confirmed exploit activity yet. Based on the description, it is inferred that the attack vector requires local authorized user access to trigger the overflow, implying a local privilege escalation scenario. Prompt application of the vendor’s security update is recommended to mitigate this risk.