A heap-based buffer overflow (CWE‑122) in the Windows USB driver allows an authorized attacker to execute code with higher privileges than the current user. The vulnerability can lead to complete compromise of the affected machine. The description indicates the flaw is exploitable locally, so it is inferred that the attacker needs physical or preexisting local access to a USB device or ability to install a malicious driver on the target system.

Affected builds include Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 across x86, x64, and ARM64 architectures.

The CVSS score of 7.8 places this vulnerability in the high severity range. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires local access, which may involve a physical USB device or a preinstalled driver; once achieved, the attacker can gain administrative privileges and full system control.