A heap-based buffer overflow exists in the Servicing Stack Updates component of Microsoft Windows products that allows an authorized local attacker to increase their privileges. The flaw is categorized as CWE‑122. Once exploited, the attacker can gain higher administrative rights, potentially giving them full control over the affected system and allowing compromise of confidentiality, integrity, and availability of data and services.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025, including the Server Core installations.

The CVSS score of 7 indicates a high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, pointing to a moderate exploitation likelihood. The attack vector is inferred to be local, requiring the attacker to be already authorized on the system. Exploitation would typically occur during the servicing stack update process, where a malformed memory access overwrites the heap, leading to privilege escalation. As no public exploit samples are reported yet, the exact exploitability remains uncertain, but the combination of a high CVSS and local execution requirements makes it a significant risk for unpatched systems.