A heap-based buffer overflow exists in the Windows Client‑Side Caching (CSC) Service. When triggered by an attacker with local authority, the overflow allows the attacker to raise their own privileges on the affected machine. The flaw is a classic out‑of‑bounds write in dynamic memory, as identified by the CWE‑122 classification. The impact is a full local privilege escalation, potentially enabling the attacker to install software, access or modify data, and persistently compromise the system.

The vulnerability affects multiple Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; as well as a range of Server editions: Windows Server 2012, 2016, 2019, 2022, and 2025. Both 32‑bit and 64‑bit builds, plus ARM64 variants, are listed as impacted. All these systems host the CSC Service, which may be enabled for network file caching and opportunistic offline access.

The CVSS score of 7.8 indicates a high severity vulnerability. No EPSS data is available, but the flaw requires local authorized access; therefore, the attack vector is likely local. It is currently not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting that public exploitation has not been confirmed. Nonetheless, the combination of a local privilege escalation and the high CVSS rating means that any compromised user account can exploit this flaw to gain elevated rights on the host. Organizations should treat this as a significant risk until a patch is applied.