A heap‑based buffer overflow in the Windows kernel enables an attacker who is already logged on to a local account to raise its privileges to the highest level. The flaw, classified as CWE‑122, occurs when the kernel does not properly bound memory writes driven by user input, allowing an attacker to overwrite critical data structures and execute arbitrary code with system rights. The impact is full control over the affected machine, providing the potential to tamper with files and settings, disable services, or deploy additional malware.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (arm64), 26H1, and 26H2 (x64); Microsoft Windows Server 2019, Server 2022, and Server 2025, including Server Core installations. All listed variants are subject to the same kernel bug that permits privilege escalation when the system is running the un‑patched code.

The CVSS score of 7.8 indicates a high‑severity local privilege escalation vulnerability. Although the EPSS score is not currently available and the vulnerability is not listed in the CISA KEV catalog, the absence of a widespread exploitation record does not remove the risk; any local user can leverage the flaw if they have the ability to run malicious input against the kernel. The attacker must first be authenticated and have permission to send data to the vulnerable kernel routine, implying the attack vector is local. Given the severity and the kernel‑level nature of the bug, organizations should treat this as a critical priority for patching.