A heap-based buffer overflow in the Windows Management Instrumentation (WMI) component can be triggered by an authorized attacker, allowing the attacker to elevate privileges locally. The flaw is a classic memory corruption bug classified as CWE-122 and exploits corrupted heap metadata during normal WMI operations. The impact is a local privilege escalation that permits the attacker to gain higher access rights on the affected machine.

Microsoft Windows 10 builds from 1607 through 22H2, Windows 11 releases from 23H2 through 26H2—including x86, x64, and arm64 architectures—and Windows Server editions from 2012 to 2025, including both core and full installations, are affected by this vulnerability.

The CVSS score of 7.8 places this flaw in the High severity range, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been actively exploited in the wild. Exploitation requires that the attacker be an authorized local user, which is a realistic scenario in environments with insufficient local account controls. The likely attack vector is local execution, inferred from the need for local authentication to trigger the heap overflow. Operators should consider the risk moderate to high and apply the necessary fix promptly.