A heap-based buffer overflow exists in the Windows Sensor Data Service. The defect allows an attacker who is already authenticated to an affected system to raise their privileges locally. The vulnerability is a classic buffer overflow (CWE‑122) that can corrupt memory and lead to code execution within the context of an elevated account, increasing risk of system compromise. The impact is limited to the local machine and requires the attacker to have already logged in or gained some level of local access. No remote attack vector is mentioned, so exploitation must occur from a local foothold. The description does not specify which privilege level can be achieved, but the exploit can elevate a standard user to an administrator or system level depending on the context.

Affected releases include multiple versions of Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H2, 23H2, 26H1), and several Windows Server releases (2016, 2019, 2022, 2025) in both server core and full installations. The list of affected products is derived from Microsoft’s official CNA details. The vulnerability applies to both x86 and x64 architectures, as well as ARM64 where documented.

The CVSS v3.1 score of 7.8 indicates high severity, and the exploit is considered likely if an adversary already has local access. The EPSS score is not available, so the precise probability of exploitation cannot be quantified at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting that no known widespread exploitation has been reported. Based on the requirement for local authenticated access, the likely attack vector is a user‑initiated exploit carried out from a compromised or trustworthy account on the target machine.