The identified flaw is a heap-based buffer overflow within the Windows Win32 Kernel Subsystem. An attacker who can run code locally with user privileges can trigger the overflow to write arbitrary data into kernel memory, allowing the attacker to elevate privileges on the affected system.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2016, 2019, 2022, and 2025, including both regular and Server Core installations.

The CVSS score of 7.8 places this vulnerability in the high severity range. No EPSS score is available, and the vulnerability is not flagged in the CISA KEV catalog, implying no widely disclosed exploit. The likely attack vector is local: an authorized user or a process with user rights must be present to trigger the buffer overflow, after which privilege escalation is achieved.