This vulnerability is a heap‑based buffer overflow in the Windows Fax Service that lets a local attacker who already has system access elevate privileges to a higher level. By overflowing a heap buffer, the attacker can manipulate the state of the service and gain the ability to modify system configuration, install or run arbitrary code, or perform other privileged actions. The flaw is a classic instance of CWE-122 and results in a local privilege escalation, giving the attacker a higher level of control than originally granted.

The vulnerability affects several Microsoft Windows operating systems, including Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H1; and various Windows Server releases from 2012 through 2025 (including Server Core installations). Every affected Windows version that includes the Windows Fax Service is impacted, regardless of architecture (x86, x64, ARM64).

The CVSS score of 7.8 indicates a high severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, implying no confirmed exploitation in the wild as of the last update. The likely attack vector is a local path requiring authenticated access to the target machine; an attacker could exploit the flaw by submitting a specially crafted fax job or otherwise interacting with the service to trigger the overflow. Successful exploitation would result in privileged access that could be leveraged to compromise the host.