A heap-based buffer overflow flaw exists in the Desktop Window Manager that permits an authorized local attacker to gain higher privileges on the affected Windows operating systems. The vulnerability is a type of memory corruption weakness that could allow the attacker to execute privileged code, potentially escalating to system-level access. The description identifies the impact as local privilege escalation, without implying remote exploitation or denial of service.

Microsoft Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2019, Server 2019 (Core), Server 2022, Server 2025 (Core). All impacted releases run on x86, x64, or ARM64 architectures as indicated by the CPE entries.

The CVSS score of 7.8 indicates a high severity local privilege escalation risk. The EPSS score is not available, so the likelihood of exploitation is not quantified, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited in the wild yet. The flaw can be triggered by a local user with the ability to launch Desktop Window Manager or its dependent components. Once the buffer is overflowed, an attacker could execute arbitrary code under a higher privilege level. The lack of remote access requirements limits the attack surface to only authorized users or compromised local accounts.