A heap‑based buffer overflow exists in the Windows Storage component, which can be triggered by an authorized local user. An attacker who can execute code in that context may overflow a buffer and overwrite control data, enabling them to gain higher privileges on the affected system.

Vulnerable builds of Windows 10 (Version 1607, 1809, 21H2, 22H2), Windows 11 (Version 23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server 2012 up through 2025, including both full and server core installations.

The CVSS score of 7 suggests a substantial impact if exploited, and the vulnerability is localized to systems where the attacker already has an authorized account. Since the EPSS score is reported as <1%, the exploitation likelihood is low but not zero, and the issue is not currently listed in CISA’s KEV catalog. The local attack vector requires privileged or near‑privileged access to trigger the overflow.