A heap‑based buffer overflow exists in the Windows TCP/IP stack, enabling an authorized local user to gain higher privileges on the affected system. The flaw allows the attacker to write beyond the bounds of a heap allocation while processing TCP/IP traffic, resulting in execution of code in the context of the system. The consequence is a local privilege escalation that can permit the attacker to obtain administrative rights or perform actions normally restricted to privileged accounts.

Microsoft Windows operating systems are affected, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1; and the Windows Server family covering Server 2012, 2012 R2, 2016, 2019, 2022, and 2025.

The reported CVSS score of 7 indicates a moderate to high severity, while the EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to have an authorized local account; the flaw is triggered by the processing of TCP/IP traffic, suggesting that the attacker could use crafted packets but only from within the local environment. Given the lack of remote attacker prerequisites, the risk is typically confined to users who already have access to the machine, though the impact of local elevation is significant.