A heap‑based buffer overflow exists in the Windows Search component, allowing an authorized local user to manipulate memory and gain higher privileges on the system. The flaw is a classic stack corruption vulnerability (CWE‑122).

Microsoft products affected include Windows 10 builds 1607, 1809, 21H2, and 22H2; Windows 11 builds 23H2, 24H2, 25H2, 26H2, and 26H1; as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both standard and Server Core installations.

The CVSS score of 7.8 indicates a high severity local privilege escalation risk, while the EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated local user to trigger the overflow via the Windows Search interface; thus the attacker needs to be logged on to the compromised machine and has some capability to influence search queries.