A heap-based buffer overflow in the Windows Search Component allows an attacker with local access to elevate privileges. Identified as CWE-122, the flaw can corrupt heap memory used by the component, potentially enabling unauthorized code execution. The result is a local privilege escalation that threatens confidentiality, integrity, or availability of the entire system.

Affected systems include Windows 10 from version 1607 through 22H2, Windows 11 from 23H2 to 26H2 (including the 26H1 release), as well as Windows Server 2012 and 2012 R2 (including Server Core installations), Windows Server 2016, 2019, 2022, and 2025. Both x86 and x64 architectures are covered, and ARM64 builds of Windows 11 are listed in the CPE data. No specific patch levels are provided in the source information.

The CVSS score of 7.8 reflects a high‑severity local privilege escalation. EPSS is not available, so the exact exploitation probability is unknown, but the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits at this time. The likely attack vector requires an authorized local user or account with sufficient privileges to trigger the overflow, making the risk significant for environments where users operate with elevated rights.