The vulnerability is a heap‑based buffer overflow in the Windows Common Log File System Driver, identified as a classic buffer overflow (CWE‑122). It allows an attacker with local authorization to exploit a memory corruption condition and gain higher privileges on the compromised system. The resulting elevation of privileges can enable the attacker to run arbitrary code, modify system configuration, or install persistent malware, thereby compromising confidentiality, integrity, and availability of the affected machine.

The flaw is present in a broad range of Microsoft Windows operating systems. It affects Windows 10 from version 1607 through 22H2, Windows 11 from 23H2 up through 26H2 (including ARM64 and x86/x64 builds), and several Server releases from Windows Server 2012 to Windows Server 2025. All architectural variants listed in the CPE strings—including x86, x64, and arm64—are impacted.

The CVSS score of 7 indicates high impact when the vulnerability is successfully abused. Ephemeral risk is unclear because EPSS data is not available; however, the lack of public exploitation and the absence from the CISA KEV catalog suggest that exploitation remains limited or requires advanced capabilities. The attack vector is local: an authorized user or process that can execute code on the target host can trigger the overflow. In total, the security assessment balances a high severity with a currently low likelihood of widespread exploitation, but the potential damage is substantial.