The vulnerability is a heap‑based buffer overflow in the Windows kernel that enables an attacker who already has local access to the system to elevate his or her privileges. The flaw arises when an authorized process writes data beyond the bounds of a heap buffer, allowing overwrite of kernel memory structures. Once the overflow is triggered, the attacker can gain higher‑privilege access, potentially compromising the entire system. The weakness corresponds to CWE‑122, a heap buffer overflow that can lead to privilege escalation.

Microsoft Windows 10 (versions 21H2 and 22H2), Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H2 and 26H1; all applicable architectures including x86, x64 and arm64), and Microsoft Windows Server 2022 and 2025 (including Server Core installations). Vulnerable releases are those listed in the Microsoft Update Guide for CVE‑2026‑83736.

The CVSS score is 5.5, indicating a moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The flaw requires an attacker to already be present on the target machine (i.e., a local attack vector). Exploitation would involve triggering a controlled kernel heap overflow, a step that normally demands a custom exploit or elevated privileges, so the likelihood of widespread exploitation is low. Nonetheless, local users with sufficient access can abuse the flaw to gain system‑level rights.