A heap‑based buffer overflow exists in the Windows Camera Frame Server Monitor component. When exploited by a user who already has local access, the flaw allows the attacker to overwrite critical heap memory and execute arbitrary code with the privileges of the compromised process, effectively elevating to SYSTEM or another high‑privileged account. This privilege escalation can be used to compromise system integrity and confidentiality, granting the attacker full control of the affected machine.

Microsoft Windows 10 21H2 and 22H2, Microsoft Windows 11 23H2, 24H2, 25H2, 26H2 and 26H1, Microsoft Windows Server 2022, and Microsoft Windows Server 2025 (including the Server Core installation). The affected binaries run on both x86 and x64 architectures as well as ARM64 for the Windows 11 build 26H2.

With a CVSS score of 7.8, the vulnerability is classified as high severity; the EPSS score is 0.00318, indicating a very low probability of exploitation, and it is not listed in the CISA KEV catalog. The logical attack vector is local: an authenticated user must already have access to the system. Once the overflow is triggered, the attacker can gain system‑level privileges, enabling any further exploitation such as installing persistent backdoors or modifying critical operating system components. The impact is therefore considered high, but practical risk depends on the local user base and the ability to satisfy the local execution requirement.