A heap-based buffer overflow exists in Windows Management Instrumentation (WMI). This flaw can be triggered by a locally privileged attacker, enabling the attacker to write beyond the bounds of a heap buffer. The overflow allows execution of arbitrary code with elevated rights, raising a user's privileges within the system. The vulnerability is classified as CWE‑122, a classic out‑of‑bounds write that threatens the confidentiality and integrity of the host.

The issue affects numerous Microsoft Windows releases. By vendor and release, the affected versions include Windows 10 starting from 1607 through 22H2, Windows 11 from 23H2 onward (including 24H2, 25H2, 26H2 and 26H1), as well as Windows Server from 2012 (all editions and server core) up to Windows Server 2025. Systems running any of these builds are vulnerable until a patch is applied.

The CVSS base score of 7 denotes high severity, but the absence of an EPSS value means the current exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. Since it requires local access and privileges, an attacker must already have a foothold on the machine to abuse the flaw. However, once local access exists, gaining elevated rights poses a significant risk to the entire system.