A heap-based buffer overflow in Microsoft OpenSSH for Windows enables an attacker who already has local authorization to elevate their privileges, allowing access to higher-level system functions or sensitive data. This vulnerability falls under CWE‑122, indicating insufficient bounds checking during memory allocation, and is further characterized by CWE‑367, a race condition that may exacerbate the overflow. The exploit requires the attacker to invoke the vulnerable code path while having sufficient local credentials, implying that the attack vector is local rather than remote.

The flaw affects multiple Microsoft Windows releases, including Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (arm64), 26H1; and Windows Server 2019, 2022, and 2025, both standard and Server Core installations. Users running these operating systems with the bundled OpenSSH for Windows component are vulnerable according to the vendor's official advisory.

The CVSS base score of 7.0 classifies this issue as high severity, and the fact that it is a local privilege escalation increases its impact for systems with insufficient user privilege separation. EPSS data is not available, so the exploitation probability is uncertain; however, the vulnerability is listed as not part of the CISA KEV catalog, suggesting no publicly known live exploits are reported. The detection and exploitation would likely involve local interaction with the OpenSSH service, meaning that defenders should assume a potential threat from insiders or compromised user accounts.