The vulnerability is a heap-based buffer overflow located within the Windows DHCP Server component. When triggered, it allows an attacker who already has local, authorized access to the system to increase their privileges to that of the service, effectively granting elevated rights. The exploit does not appear to provide remote code execution – the attacker must be able to inject or influence the DHCP Server process while already on the network.

Affected are multiple editions of Windows 10, Windows 11, and a range of Windows Server releases including 2012, 2012 R2, 2016, 2019, 2022, and 2025. All listed versions of these operating systems, whether standard or Server Core, are impacted by the buffer overflow.

The CVSS score of 7.8 places the flaw in the moderate to high severity range. The EPSS score is not available and the vulnerability is not currently listed in CISA’s KEV catalog, indicating that large‑scale exploitation is not yet documented. Because the attack requires local authorized access to the DHCP Server, the practical risk is primarily for environments where privilege boundaries are already blurred. Nonetheless, local attackers could use the escalation to gain system privileges on the affected host, potentially compromising any sensitive data or services running there.