A heap‑based buffer overflow exists in the Windows Group Policy subsystem. The flaw allows an attacker who can execute code locally with sufficient privileges to manipulate the policy engine’s heap allocation, resulting in privilege escalation. This vulnerability is classified as CWE-122 and permits elevation of synthetic local privileges without requiring an exploit from the network.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, 2025, including their Server Core variants.

The vulnerability carries a CVSS score of 7.8, indicating high severity for local attackers. While the EPSS score is not available, the absence of a KEV listing suggests no widespread exploitation yet, but the nature of the flaw provides a clear local attack vector for authenticated users who can run code or influence Group Policy Objects. If leveraged, an attacker could gain elevated privileges on the affected hosts, affecting confidentiality, integrity, and availability within the local scope.