The vulnerability is a heap‑based buffer overflow in the Servicing Stack Update process that allows an authorized local attacker to overwrite memory and gain higher privileges on the host. This flaw is a classic memory corruption weakness (CWE‑122) that can be triggered when the update code loads vulnerable data pages into memory. If successfully exploited, the attacker could elevate a standard user to an administrator or system level, enabling further compromise or persistence within the environment.

Microsoft Windows 10 Versions 1607, 1809, 21H2, 22H2 (x86 and x64 as applicable), Microsoft Windows 11 Versions 23H2, 24H2, 25H2, 26H2, 26H1 (ARM64 and x64 variants), Microsoft Windows Server 2012, 2012 R2 (core and non‑core), Windows Server 2016, 2019, 2022, 2025, as well as the corresponding arm64 and x64 builds described in the Microsoft vendor listing.

The CVSS score of 7.8 places this flaw in the high severity range, indicating significant risk if exploited. EPSS data is unavailable, but the vulnerability is not known to be in the CISA Known Exploited Vulnerabilities catalog, suggesting limited current exploitation activity. The likely attack vector is local: an attacker who already has user‑level access or can execute code in the context of the Servicing Stack Update process can trigger the overflow. While no remote access is required, the attack demands privileged local execution for the fix to be applied, making environments with inadequate least‑privilege controls particularly susceptible.