A heap-based buffer overflow exists in the Windows PCI Bus Driver that can be triggered by a local user with authorized access. Exploitation of this flaw allows the attacker to gain higher privileges on the target machine, potentially enabling full control over the system and the ability to execute arbitrary code as an elevated user.

Microsoft Windows 10 versions 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core).

The CVSS score of 7.8 marks this vulnerability as high severity. The EPSS score is not available, so the probability of exploitation is not quantified; however, the flaw requires a local, authorized user to achieve privilege escalation. Because it is not listed in the CISA KEV catalog, there is no current evidence of widespread exploitation, but the potential consequences warrant rapid remediation.