The vulnerability is a heap-based buffer overflow in the Windows Win32 Kernel Subsystem. Based on the description, it is inferred that an attacker requires physical access to craft input that causes the kernel to write beyond a buffer boundary, creating or executing code with system privileges and thereby achieving local privilege escalation.

All supported Windows releases enumerated by Microsoft are affected, including Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and the full editions of Windows Server 2019, 2022, and 2025. The vulnerability also applies to the Server Core installations of Windows Server 2019 and Windows Server 2025, covering both x86, x64, and ARM64 platform builds as detailed in the supplied CPE data.

The CVSS score of 6.8 indicates moderate severity. Because exploitation requires physical presence and there is no publicly available exploit code yet, the risk of widespread exploitation is moderate, and the vulnerability is not currently listed in the CISA KEV catalog. Organizations should limit physical access and apply forthcoming Microsoft patches when released.