A heap-based buffer overflow in the Windows USB driver allows an attacker who already has local access to elevate their privileges on the affected system. It is inferred that the elevation of privileges could provide access to resources normally restricted to higher‑privileged accounts. The weakness is classified as a classic buffer overflow and directly compromises the integrity of the system for the account that exploits it.

The vulnerability impacts a broad range of Microsoft Windows operating systems, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1 (both x64 and arm64 variants); and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations). All listed releases are affected regardless of architecture, as indicated by the CPE data provided.

The CVSS base score of 7.8 indicates a high‑severity local privilege escalation with limited attack surface. Because the exploitation requires local ownership of the machine, the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely weaponized. It is inferred that an attacker with local access might craft a malicious USB device and leverage the buffer overflow to run code with elevated rights, posing a risk for any organization that allows untrusted USB devices or does not enforce strict least‑privilege controls.