A heap-based buffer overflow exists in the Windows Bind Filter Driver that can be triggered by a user who has local authorized access. Exploitation of the flaw results in elevation of privileges, allowing the attacker to gain higher rights on the compromised system. This vulnerability is a classic example of a memory corruption weakness (CWE-122).

The affected products include multiple Windows 10 and Windows 11 releases (21H2, 22H2, 23H2, 24H2, 25H2, 26H2 for both x86 and x64, and ARM64 variants), as well as Windows Server 2022 and Windows Server 2025, including Server Core installations. The CPE list confirms that all of these versions are impacted.

The CVSS score of 7.8 indicates a high severity for local privilege escalation. Because the EPSS score is not available, the likelihood of immediate exploitation is unclear, and the vulnerability is not currently listed in the CISA KEV catalog. An attacker must already have local access and some level of authority to trigger the overflow; however, once executed, the attacker can achieve system‑wide privileges. The attack path is purely local and does not require remote exposure.