An out‑of‑bounds write flaw exists in the Windows EAPHost Service. The flaw can be triggered by a local attacker who already has authenticated access to the target system. Successful exploitation leads to the execution of code with higher privileges, allowing the attacker to gain administrative rights on the machine.

Affected by Microsoft: Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (including Server Core installations).

The CVSS score of 7.8 places this vulnerability in the high severity range, meaning that successful exploitation could have serious impact on confidentiality, integrity, or availability. The EPSS score of <1% indicates a very low exploitation probability in the current environment, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local privileged access; an attacker must first authenticate to the system and then exploit the EAPHost Service to obtain elevated rights.