This vulnerability is a heap-based buffer overflow in the Windows Event Tracing subsystem that permits an unauthorized local user to execute arbitrary code with the privileges of the process that interacts with event tracing. The flaw stems from improper bounds checking on user-controlled input, classified as CWE-122 and CWE-191, and could lead to local compromise of data confidentiality, integrity, or availability.

Affected systems include Microsoft Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 up to 26H2, and Windows Server 2012 through 2025. All listed operating systems contain the vulnerable event tracing component.

The CVSS score of 7.8 indicates a high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The flaw is a heap overflow and requires local access; an attacker must execute malformed event trace data in a local context, which would allow code execution with the privileges of the user interacting with the subsystem. Because the vulnerability is local, remote exploitation is not possible unless an attacker already has local access.