The vulnerability is a heap-based buffer overflow in the Windows Search component, allowing an attacker with authorized local access to supply malicious input that corrupts memory and executes arbitrary code with elevated privileges. This flaw enables bypassing normal Windows privilege boundaries and is identified as CWE‑122, indicating insufficient bounds checking during heap allocation for search queries.

Affected operating systems include Windows 10 builds 1607 through 22H2, Windows 11 builds 23H2 through 26H2 (including arm64 and x64 variants), and Windows Server releases 2012 through 2025 (and their Server Core editions). Each of these builds incorporates the Windows Search service that contains the vulnerable code; systems running these versions without the latest cumulative update remain susceptible.

The CVSS score of 7.8 denotes a high severity with local privileges. Although the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, the potential for exploitation is significant for users who can log on locally or through remote services. The exploit requires an attacker to act within an authorized session, meaning threats typically arise from compromised user accounts or physical access. While there are no confirmed public exploit campaigns, the nature of the flaw justifies prompt remediation.