A heap-based buffer overflow in Windows Direct Composition allows an authorized local attacker to elevate privileges, enabling the execution of privileged code. The weakness, identified as CWE‑122, permits malicious manipulation of memory during component composition, resulting in escalation of the attacker’s access level.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1; Windows Server 2016, 2019, 2022, 2025; both the full and Server Core installations of each edition are affected.

The vulnerability has a CVSS score of 7.8, indicating a moderate to high severity. EPSS score is 0.00355 (< 1%), indicating a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a local authorized user, making the exploitation requirement moderate but significant for systems with privileged users. Applying the vendor patch mitigates this risk.