The flaw is an integer overflow or wraparound in the Windows USB Video Driver that can be triggered by an authorized local attacker. The vulnerability allows the attacker to gain elevated privileges on the compromised system. The weakness is identified as CWE-190. The impact is a local privilege escalation that can enable further damage or lateral movement if the attacker holds a normal user account.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server 2016, 2019, 2022, 2025, including their Server Core installations are affected.

The CVSS score of 7.8 indicates a moderate to high severity for local privilege escalation. The EPSS score is not available, implying no current public exploitation data. The vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is local, requiring an authorized attacker to have physical or remote access to a USB video device. The exploitation requires the attacker to drive the vulnerable driver into a state where the integer overflow occurs, after which privilege escalation is achieved. Given the local nature and lack of current exploit data, the overall risk is moderate but should be addressed promptly.