The vulnerability is a heap‑based buffer overflow in the RPC Runtime that allows an attacker who already has local access to elevate privileges. Overflowing the heap can corrupt memory and lead to the execution of arbitrary code with higher rights, giving the attacker full control over the affected system.

Microsoft Windows 11 builds 23H2, 24H2, 25H2, and 26H1 on both x64 and arm64 architectures are vulnerable; the CPE strings reference these specific releases.

The CVSS score of 7.8 indicates this flaw is of high severity. No EPSS data is available and the vulnerability is not in the CISA KEV catalog, so the current exploitation probability is unknown. The description infers that the attack vector is local with an authorized user; reaching the overflow requires executing code within the RPC Runtime on the affected Windows 11 system.