An integer overflow or wraparound flaw exists in the Windows HID Parser Library that allows an attacker with local authorized access to elevate their privileges. The vulnerability can be used to gain higher system rights, which could enable the attacker to compromise system integrity and confidentiality. No remote exploitation is reported and the flaw requires the attacker to already be authenticated on the affected system.

Affected operating systems include Microsoft Windows 10 versions 1809, 21H2, and 22H2, as well as Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (Arm64), 26H1 (x64), and Microsoft Windows Server 2019, Server 2019 (Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core). Users should verify the specific build of their Windows installation against the Microsoft update guide for CVE-2026-83877.

The CVSS score of 7.8 indicates a high severity, and the EPSS score is not available, implying limited publicly documented exploitation data. The vulnerability is not currently listed in the CISA KEV catalog, but the lack of known exploits does not diminish the risk for local users. The attack vector is clearly local and requires an authorized user, meaning that privileged accounts or users with sufficient local access could leverage the integer overflow for local privilege escalation. The risk is elevated for systems that are not yet patched to the latest builds provided by Microsoft.