A heap-based buffer overflow in Windows kernel-mode drivers can be triggered by an authorized local user, enabling that user to gain system privileges. This flaw involves a memory corruption condition that allows the attacker to overrun a buffer in driver heap space and overwrite control data, a classic buffer overflow that directly compromises the integrity of the operating system kernel. The lack of proper bounds checks permits privilege escalation without affecting system availability, but the confidentiality and integrity of all data accessed by the elevated process are at risk.

Microsoft Windows operating systems including Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and several arm64-based builds, as well as Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 (all core and full installations). The vulnerability is present in kernel drivers shipped with each of these editions.

The CVSS base score of 7.8 indicates high severity, and while the EPSS score is not available, the lack of assignment in the CISA KEV list does not diminish the risk. The attack vector is inferred to be local, requiring the attacker to have authorized direct access to the target machine and the ability to load or trigger the vulnerable kernel-mode driver. Successful exploitation results in a full escalation to system level, giving the attacker comprehensive control over the affected environment. Because the flaw resides in core kernel components, the consequences per successful exploitation are severe and the availability of the system is typically unaffected but the operating system’s integrity is permanently compromised.