The vulnerability is a heap-based buffer overflow in the Windows Volume Manager Extension Driver, which allows an attacker who has local access to the machine to gain higher privileges. The flaw permits writing past allocated bounds in a heap buffer, potentially enabling execution of arbitrary code with elevated rights. This can compromise confidentiality, integrity, and availability of the affected system. The weakness is categorized as CWE-122.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H1 and the Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025.

The CVSS score of 7.8 indicates a high severity for a privilege‑escalation flaw, but the EPSS score is not available so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits yet. The likely attack vector is local, requiring the attacker to already have some form of local access; indirect exploitation would require additional user interaction or credentials.