The flaw is a heap-based buffer overflow in the Windows Search Component that allows a privileged local user to elevate their privileges to higher levels on the affected system. The overflow can likely be triggered by a crafted search query or a specially prepared file that causes the search service to write beyond a heap buffer limit. When successfully exploited, an attacker could gain elevated rights and potentially take control of the machine or other user accounts. This vulnerability is classified as CWE-122.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, including arm64 and x64 editions; Windows 11 version 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, in both full and Core installations.

The CVSS score of 7.0 indicates moderate severity for local privilege escalation, and the EPSS score of less than 1% indicates a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no active exploits are known. An attacker would need local access with user privileges and the ability to trigger the overflow, likely by executing a crafted search query or manipulating an indexed file. The scenario demands local interaction and does not imply remote exploitation.