A heap‑based buffer overflow (CWE‑122) in the Windows Storage Spaces Controller allows an attacker who already has local access to a system to build a crafted payload that corrupts heap memory and elevates their privileges. The resulting privilege escalation can enable the attacker to modify system configuration, install software, or compromise other user accounts, thereby threatening confidentiality, integrity, and availability of the affected environment.

The vulnerability affects multiple Microsoft Windows releases: Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations.

The CVSS score of 7.8 indicates high severity, while the EPSS score is not available, leaving the exact likelihood of exploitation uncertain. The vulnerability is not listed in the CISA KEV catalog, yet its local privilege escalation nature makes it a serious risk for organizations that rely on Storage Spaces. The likely attack vector is local, requiring the attacker to already possess legitimate user rights to interact with the vulnerable component.