A heap-based buffer overflow occurs within Windows Direct Composition, enabling an attacker who already has authorized local access to elevate privileges. The flaw allows the attacker to gain higher privileges, potentially allowing full system compromise. The vulnerability is categorized as a buffer overflow.

Microsoft Windows 11 version 24H2, 25H2, and 26H2 for arm64-based systems, as well as Microsoft Windows Server 2025 including Server Core installations.

The CVSS score of 7.8 indicates high severity. An authorized local user could exploit the overflow, but the attack requires local presence and does not rely on remote network access. The EPSS score is not available and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting limited public exploitation data at present, though the high CVSS indicates a significant risk should an attacker obtain local access.