This vulnerability is a heap-based buffer overflow that allows an authorized local attacker to gain elevated privileges on the affected Windows systems. The flaw is caused by improper bounds checking during memory allocation, as represented by CWE-122. In addition, a race condition (CWE-362) further assists the attacker in corrupting memory state before the overflow occurs. Successful exploitation can provide the attacker with higher privilege levels on the target machine, potentially allowing system compromise.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (arm64), 26H1 (x64). All variants of Windows Server 2012 R2 (including Server Core), Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core) are affected.

The CVSS score of 7 indicates a medium to high severity of the elevation flaw. The EPSS score is not available, so the current exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation yet. Attackers need local, authorized access to trigger the overflow; the vulnerability cannot be exploited remotely without first authenticating. Because the flaw requires local execution, mitigations that reduce local privilege escalation opportunities are critical.