A heap‑based buffer overflow exists in Windows Media, allowing an authorized local attacker to gain elevated privileges. The flaw is a classic CWE‑122 overflow; exploitation would manipulate the memory allocator to override control data, enabling the attacker to break out of the restricted user context and run code with higher rights. The impact manifests as a local privilege escalation, potentially compromising the entire system, data, and network resources if the attacker subsequently leverages other vulnerabilities.

The vulnerability affects a wide range of Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, with or without Server Core installations. The affected software is identified by the CPE strings provided, covering x86, x64, and ARM64 variants.

The CVSS score of 7.8 indicates a high severity and the vulnerability is exploitable only by users who already have local presence on the system. The EPSS score is not available, so the exact market exploitation probability is unknown; however, the lack of a KEV listing suggests no widely documented public exploits yet. The likely attack vector, inferred from the description, is through a crafted media file or application that triggers the overflow during normal media processing operations by an authorized user. Because the flaw requires local access, organizations should treat it as high risk for systems that provide users the ability to open or preview media files.