A heap‑based buffer overflow in Windows Internet Information Services allows an attacker who can execute code locally to gain higher privileges, potentially executing arbitrary code, modifying system files, or taking full control of the machine. The weakness is described as a buffer overflow (CWE‑122), breaking memory bounds and undermining program integrity.

Affected releases include Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025, both standard and Server Core. All are impacted through the Internet Information Services component.

The CVSS score of 7.8 indicates a high risk for systems that permit local code execution. EPSS information is not available, leaving the exploitation frequency uncertain. Microsoft does not list this vulnerability in the CISA KEV catalog. An attacker only needs local execution privileges to trigger the overflow, after which SYSTEM level access can be achieved, enabling full OS compromise.