A heap-based buffer overflow exists in the Servicing Stack Updates component that, when triggered, lets an attacker with local authorization increase their privilege level. The flaw can be exploited to elevate from a standard user to a higher privileged account, such as SYSTEM, thereby compromising the confidentiality, integrity, and availability of the affected Windows operating system. The weakness is identified as CWE-122, indicating a lack of bounds checking during memory copy or processing.

Affected systems include multiple Microsoft Windows releases. Windows 10 is impacted from versions 1607, 1809, 21H2, and 22H2 on x86 and x64 architectures. Windows 11 is affected in versions 23H2, 24H2, 25H2, 26H2, 26H1, and the 23H2 arm64 edition, on both x64 and arm64 platforms. The vulnerability also spans the Windows Server family from 2012 through 2025, covering both standard and Server Core installations on x64 machines.

Risk and exploitability analysis shows a CVSS score of 7.8, indicating a high‑severity condition. The EPSS score is < 1 % and the flaw is not listed in the CISA KEV catalog. The most likely attack vector is a local attacker who already has legitimate user credentials; from that position, the attacker can trigger the vulnerability to gain higher privileges. The vulnerability’s local nature means external attackers are limited unless they first compromise a user session. The current lack of publicly known exploitation code, coupled with the requirement for local authorization, moderates the near‑term threat, yet the high CVSS reflects the potential damage once exploited.