This vulnerability is a heap-based buffer overflow in the Windows TCP/IP stack that, when triggered by an authorized local attacker, allows escalation of privileges. The flaw arises from improper memory bounds checking and is catalogued as CWE-122. An attacker who can control data fed to the TCP/IP parser may gain elevated rights on the compromised system, potentially enabling full system compromise or pivoting to other network resources.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations). The affected builds are listed in the Microsoft update guide and correspond to the cpe entries provided.

The CVSS score of 7.8 rates this flaw as high severity and the EPSS score is currently unavailable, implying no quantified exploitation probability. It is not in the CISA KEV catalog. The likely attack vector is local, requiring an attacker to have some user presence on the machine to craft malicious traffic that triggers the overflow. Once triggered, the attacker can elevate to local system privileges, granting full control over the affected device.