The vulnerability is a heap‑based buffer overflow in the Windows Fax and Scan Service that lets an attacker who already has a user‑level account on the system gain elevated privileges. If successfully exploited, the attacker can execute privileged commands, install software, or alter system configuration. The flaw is a classic heap overflow (CWE‑122) triggered when the service processes a maliciously crafted fax or scan request.

The affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and all Windows Server releases from 2012 through 2025, on both standard and server core installations. The Windows Fax and Scan Service is present on all these releases, so any machine running one of them may be vulnerable.

The CVSS score of 7.8 suggests moderate to high risk. The EPSS score is not available, so the probability of exploitation is unknown. Attacks require a local account, indicating a local attack vector, and there are no documented remote exploits. The flaw is not in the CISA KEV catalog, which suggests no confirmed wild exploits yet, but the nature of the heap overflow still warrants immediate remediation.