A heap‑based buffer overflow exists in Windows Event Tracing, which can be triggered by an attacker supplying malicious data over a network. The flaw allows the attacker to execute arbitrary code with the privileges of the Event Tracing service. The vulnerability is classified as CWE‑122, indicating that boundary checking is insufficient when writing to heap memory. The result is a complete compromise of the operating system if the execution context inherits system or high‑privilege rights.

The flaw affects multiple Windows operating system releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and 23H2 (arm64). It also impacts Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 in both full and server‑core installations. The affected builds span both x86 and x64 architectures, plus arm64 variants where applicable.

The CVSS score of 8.8 indicates a high severity vulnerability. No EPSS score is available, so the current exploit probability cannot be quantified, but the lack of a KEV listing does not mitigate the risk of exploitation. The likely attack vector is network‑based exploitation of the Event Tracing service, requiring the attacker to send a crafted packet or request to a target system. If the service is enabled and reachable, an adversary can achieve remote code execution by triggering the overflow, potentially gaining full control of the host.