A heap-based buffer overflow exists in the WebDAV component of Microsoft Windows. An unauthenticated attacker who can reach the WebDAV service can send a crafted request that overflows a heap buffer, causing memory corruption that the vendor states can be leveraged for privilege escalation. The flaw exploits input handling weakness (CWE-122). No authentication is required, making it potentially exploitable by remote hosts that can reach the WebDAV endpoint.

Microsoft Windows 10 releases starting with version 1607 through 22H2, Windows 11 releases from 23H2 through 26H2 (including ARM64 and x64 variants), and Windows Server 2012 through 2025 including Server Core variants. Systems that have the standard WebDAV service enabled are affected.

The CVSS base score is 8.8, indicating high severity. The EPSS score is not available, so the known likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to the WebDAV service; the flaw could allow privilege escalation on the target machine. Systems that expose WebDAV to the internet or untrusted networks face significant risk.