The vulnerability is a heap-based buffer overflow in the Windows Partition Management Driver that permits an authorized local attacker to elevate privileges. The flaw allows overflow of a heap buffer during partition operations, thereby enabling the attacker to execute arbitrary code with higher privileges. The weakness corresponds to CWE-122 and is assessed with a CVSS score of 7.8, indicating a high risk for damage.

Victims include Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025. Both client and server operating systems are impacted, covering x86, x64, arm64 architectures as listed in the CPE entries.

Risk assessment shows a CVSS score of 7.8. The EPSS score is unavailable, but the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires a local, authorized user, implying that attackers with local console or remote management privileges can activate the flaw through privileged partition‑management operations. The local scope and requirement for authorized access reduce the attack surface but still allow privilege escalation on the affected machines.