A heap-based buffer overflow exists in the Windows Push Notifications component. An attacker who is authorized to run code on the local machine can exploit this flaw to increase their privileges, potentially allowing them to install malware, bypass security controls, or access restricted data. The vulnerability is classified as CWE-122, indicating that insufficient bounds checking can lead to memory corruption and escalation of privileges.

Microsoft Windows 10 build versions 1607, 1809, 21H2, and 22H2; Windows 11 build versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2016, 2019, 2022, and 2025 are impacted. These include both legacy and modern architectures such as x86, x64, and ARM64.

With a CVSS score of 7.8 the flaw is in the high severity range. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The exploitability is constrained to local or authorized users, though once an attacker gains local code execution they can use the buffer overflow to elevate privileges. Microsoft publishes a security update that patches the flaw; without that update systems remain vulnerable to local privilege escalation.