A heap‑based buffer overflow exists in the Windows OLE component that can be triggered by an authorized local user; exploitation allows the attacker to overwrite memory and elevate privileges on the affected system, potentially granting full control. The weakness is identified as CWE-122, a classic buffer overflow that compromises integrity and confidentiality of the affected process.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012 (including Server Core), 2012 R2 (Server Core), 2016, 2019, 2022, 2025 (Server Core).

The CVSS score of 7.8 indicates moderate to high severity; the EPSS score of < 1% shows a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker who is already able to run code on the machine can supply crafted input that overflows the buffer and escalates privileges. Because it requires local access, defenses such as restricting local user permissions and enabling AppLocker or equivalent can reduce risk.