The Windows USB Video Driver contains a heap‑based buffer overflow that enables a local attacker to overwrite memory structures. By triggering the overflow with crafted input, the attacker can gain privileges beyond those assigned to the original user session. This vulnerability is categorized as a classic out‑of‑bounds or buffer overflow (CWE‑122) and allows local privilege escalation.

Microsoft Windows 10 to Windows 11, including versions 1607, 1809, 21H2, 22H2, 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server 2012 through 2025 and their respective core installations. All editions of these operating systems that incorporate the vulnerable USB Video Driver are impacted.

The CVSS score of 7.8 marks this flaw as a high‑severity issue, while the EPSS score is 0.00318, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the exploit requires the attacker to already have authorized local access or to use a USB device that can be attached to the system, the attack vector is limited to local. Reference information indicates that no publicly available exploits have been reported; this is inferred from the absence of disclosed exploit code. Nevertheless, a local attacker could use the buffer overflow to elevate privileges to SYSTEM‑level, potentially compromising all applications running on the host.