A heap-based buffer overflow in the Windows UI Immersive Server API permits an attacker with local authorized access to gain higher privileges on the affected machine. The vulnerability, identified as CWE‑122, occurs when improper bounds checking in the Immersive Server component allows an out‑of‑range memory write on the heap. Successful exploitation results in elevated rights for the attacker, potentially enabling full system compromise if the victim’s account has any level of local presence. The flaw is strictly a local privilege escalation; remote exploitation is not supported by the description.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, across x86, x64, and ARM64 platforms, and Microsoft Windows Server 2012 through 2025, including Server Core installations, are affected.

The CVSS score of 8.8 marks this flaw as high severity, indicating substantial potential impact. Exploit probability is presently not documented in EPSS, and the vulnerability is not listed in the CISA KEV catalog, so while the theoretical risk remains high, actual exploitation likelihood is uncertain. The attack vector is clearly local; an adversary must already have some form of authorized access or be able to execute code under a limited account to leverage the overflow.