The vulnerability is a heap‑based buffer overflow present in the HID Parser Library. When an input parameter is not properly validated, an attacker with local authorization can corrupt memory and execute code with higher privileges. This flaw is classified as CWE‑122, indicating a typical buffer overflow that can lead to local privilege escalation.

Affected Windows editions include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and the Server family – Windows Server 2019, Windows Server 2022, and Windows Server 2025, including their server‑core installations. The issue is present across x86, x64, and arm64 platforms as detailed in the vendor’s update guide.

The CVSS score of 7.8 indicates high severity, and the lack of an EPSS score means a concrete exploitation probability is not yet available. The vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation so far. Based on the description, the likely attack vector is a local attack from a user who can interact with HID devices; the exploitation requires the victim to be authenticated and to receive crafted HID input, which could come from connected devices or a malicious Windows process. Because it is a local privilege escalation, the primary impact is the ability of an attacker to gain administrative rights on a compromised machine.