A heap-based buffer overflow in the Windows Update Service allows an attacker who already has authorized access to the system to execute arbitrary code with elevated privileges. The overflow occurs when the service processes an update request, but the details of the specific triggering inputs are not disclosed. Because the vulnerability requires local authorization, the attacker does not need to compromise the network or exploit a remote vulnerability.

Affected versions include Windows 10 1607, 1809, 21H2 and 22H2 as well as Windows 11 releases 23H2, 24H2, 25H2, 26H1 and 26H2, across both 32‑bit and 64‑bit architectures where applicable. All Windows Server editions from 2012 through 2025, including server core installations, are also vulnerable.

The CVSS score of 7.8 classifies this flaw as high severity. The EPSS score is reported as less than 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating that it may not yet be widely exploited. The attack vector requires local access, implying that the attacker must already be authorised to the system to trigger the overflow. This provides a pathway to SYSTEM‑level privileges, representing a significant risk for any system where an authorised user could supply malicious update content.