The vulnerability is a heap-based buffer overflow in the Windows Win32K kernel component that allows a local user with authorized access to gain higher privileges on the system. Because the flaw is confined to local execution, an attacker must already have some level of local presence or user credentials to exploit it. Successfully exploiting the flaw would let the attacker elevate its rights to execute arbitrary code with elevated permissions, potentially compromising system integrity and confidentiality.

Affected products include Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1 on both x64 and ARM64 platforms, as well as Windows Server 2022 and Windows Server 2025 (full and Server Core installations). All aforementioned releases are impacted, but the CVE does not specify any limited sub‑versions or optional components.

The CVSS score of 7.8 indicates medium‑to‑high severity for a local privilege escalation. Explanatory data shows that the EPSS score is not available, so the exploitation probability is unknown, but the flaw is not currently listed in the CISA KEV catalog. The attack vector is local under a user that has authorized access; an attacker would need to load a crafted payload that triggers the buffer overflow within the Win32K subsystem. If compromised, the attacker can execute code at the system level, enabling full control of the affected machine.