Winlogon contains a heap-based buffer overflow that an attacker with local access can exploit to gain elevated privileges. The flaw lies in an unvalidated memory copy that permits overwriting adjacent memory, enabling unauthorized execution of code with higher privileges. This local privilege escalation is rooted in CWE‑122, a heap overflow weakness.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2 as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, including both x86, x64, and arm64 architectures. Windows Server editions from 2012 through 2025, including both full and Server Core installations, are also impacted.

The CVSS score of 7.8 indicates a high severity of local privilege escalation. EPSS is not available, so the current exploitation probability is unknown but the lack of a KEV listing suggests that no widespread exploitation has been observed yet. The likely attack vector is local, requiring an attacker to be authenticated or otherwise authorized to interact with the system; no remote exploitation path is described.