The vulnerability is a heap-based buffer overflow in the WebDAV component that permits an attacker with authorized local access to exploit a memory corruption bug and elevate privileges on the affected host. The impact is a local privilege escalation that could give the attacker administrative rights, compromising confidentiality, integrity, and availability of the machine.

The flaw affects multiple Microsoft Windows operating systems, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server releases from 2012 through 2025, both standard and Core installations.

The CVSS score of 7.0 indicates a moderate severity risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, implying that no known widespread exploitation has been reported. The attack likely requires the attacker to have local authorized access or the ability to interact with the WebDAV service on the target system, making it a local privilege escalation scenario.