Heap-based buffer overflow within the Windows COM+ Event System Service enables an attacker with local or authorized privileges to gain higher privileges. The vulnerability resides in the service’s memory handling, permitting a crafted payload to overflow a buffer on the heap and overwrite executable code, leading to the execution of attacker‑controlled instructions. If exploited, the attacker can elevate their privileges to that of the system, potentially gaining full administrative access to the affected machine.

Microsoft Windows products from Windows 10 Release 1607 onward, including Windows 10 1809, 21H2, 22H2, Windows 11 versions 23H2 through 26H2 (ARM64 and x64 variants), as well as Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations). The list of affected builds is specified by Microsoft in the CVE advisories.

The CVSS score of 7.8 classifies this as a high‑severity local privilege escalation. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires an authorized user context or local access, the attack surface is limited to users who can run code on the target machine. However, once the overflow is triggered, an attacker can execute arbitrary code at the SYSTEM level, potentially compromising the entire system or pivoting to additional hosts within the network. Given the absence of a published exploit in the public domain, the immediate risk is mitigated by patching, though the high severity warrants prompt remediation.