The vulnerability is a heap‑based buffer overflow in the Windows Common Log File System Driver. An authorized local user can trigger the overflow and gain elevated privileges, allowing the attacker to run code with administrative rights. This flaw is a classic buffer overflow (CWE‑122) that compromises integrity by enabling unintended privilege escalation.

The flaw affects a broad range of Microsoft Windows operating systems. Desktop editions include Windows 10 versions 1607, 1809, 21H2, and 22H2, and Windows 11 editions 23H2, 24H2, 25H2, 26H2, and 26H1. Server editions impacted are Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, both full and Server Core installations. All affected builds are listed in the Microsoft update guide and mapped to the corresponding CPE identifiers.

The CVSS base score of 7.8 indicates a high‑severity local privilege escalation risk. The EPSS score of less than 1 % suggests that exploitation is unlikely at this time, and the flaw is not yet listed in the CISA KEV catalog. Nevertheless, the issue requires an authorized local user, so any user with local access—especially those with administrative privileges—could exploit the driver to elevate privileges. The attack vector is local, meaning no remote exploitation is possible, but the admission of an existing local user mitigates some risk vectors while still presenting a serious threat to systems where privileged accounts are compromised.