A heap‑based buffer overflow exists in Windows OLE DB that allows an unauthorized attacker to gain elevated privileges when contacting the service over a network. The flaw can be exploited to execute code at a higher privilege level, undermining system confidentiality, integrity, and availability.

Microsoft Windows 10 (builds 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1), and a range of Windows Server editions from 2012 through 2025 and their core variants are affected.

The CVSS score of 8.8 indicates a high severity vulnerability, though the EPSS score is not available, so the probability of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation yet. Based on the description, the likely attack vector is a remote, network‑based OLE DB connection, requiring the attacker to craft a malicious payload that triggers the heap overflow and raises privilege within the target system. The weakness is classified as CWE‑122 and CWE‑125, indicating heap‑based buffer overflow and out‑of‑bounds read issues.