A heap-based buffer overflow occurs within the Windows Smart Card component when processing card data, allowing an attacker who is already authorized to use a smart card to gain elevated privileges on the local system. The flaw permits arbitrary code execution in the context of a higher-privilege account, compromising confidentiality, integrity, and availability of the affected machine.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1 (across x86, x64 and ARM64 architectures); and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025, including their server‑core installations.

The CVSS score of 7.8 indicates a high severity local privilege escalation. EPSS is not available, so the exact likelihood of exploitation in the wild is unknown, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability requires physical or local smart‑card access; consequently, the attack vector is inferred to be local. If exploited, an attacker can replace privileges on the target system and potentially compromise network resources from that foothold.