A heap-based buffer overflow in the Windows Direct Composition component permits an authorized attacker to elevate privileges on a local machine. The flaw, identified as CWE-122, allows a user with existing access to overflow a heap buffer, corrupt memory, and execute code with higher privileges. The attacker could then run arbitrary code or compromise the entire operating system if the escalation succeeds.

Affected systems include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and 23H2; and Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core). Users running any of these builds should verify that they are on a vulnerable version per the list above.

The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score of < 1% shows a very low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. The vulnerability requires local authorized access; an attacker with sufficient user privileges can trigger the overflow through Direct Composition functionality, leading to privilege escalation. The likely attack vector is local, relying on a user who can run code that interfaces with Direct Composition to trigger the heap overflow.