A heap-based buffer overflow in the Windows Direct Composition component enables a locally authorized attacker to elevate privileges on the host system. This flaw occurs when memory is incorrectly managed during composition operations, allowing the attacker to corrupt heap objects and gain higher privileges. The vulnerability is exploitable only by users who already have some local access but can use it to achieve administrative or system-level rights.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1. Additionally, all releases of Microsoft Windows Server 2016, 2019, 2022, and 2025 are impacted. These versions are listed in the CNA data and cover both x86 and x64 architectures for desktop editions and the core installations for servers.

The quantified CVSS score of 7.8 indicates a high severity with a substantial impact on confidentiality, integrity, and availability when exploitation succeeds. The EPSS score is currently unavailable, and KEV does not list it as a known exploited vulnerability, suggesting that, as of now, exploitation is not confirmed in the wild. The attack vector is local, requiring an authorized attacker who can execute code in the context of an existing user session. The risk is therefore high for environments where privilege separation is critical and where users can run applications that use Direct Composition.