The vulnerability is a heap‑based buffer overflow in the Microsoft Account component that permits an attacker who already has authorized access to a local account to elevate privileges. This flaw is consistent with CWE‑122 and CWE‑190. If successfully exploited, the attacker can overwrite or corrupt memory structures, potentially gaining higher privileges than the original account and compromising confidentiality, integrity, or availability of system resources.

Affected by this flaw are Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and all Windows Server releases from 2012 through 2025, including Server Core installations.

The CVSS score of 7.8 indicates high risk for local privilege escalation, and the lack of an EPSS score suggests the exploitation probability remains uncertain, although the attack requires local authorized access. The flaw is not listed in CISA KEV, so no known active exploitation incidents have been reported. Nonetheless, Microsoft recommends promptly applying the available security update to mitigate the risk.