A heap-based buffer overflow occurs in the Windows Storage Spaces Controller, allowing a local user who has legitimate access to the system to execute arbitrary code with system privileges. The vulnerability is a typical memory corruption flaw that can be triggered by supplying an oversized input to a function that does not correctly check bounds, resulting in an overwrite of control data. Because the attacker does not need remote access or elevated permissions to exploit, any user on the machine who can interact with the affected service can gain kernel or administrative rights.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server editions 2016, 2019, 2022, and 2025 (including Server Core installations). These include both x86 and x64 architectures for Windows 10 and all arm64-compatible Windows 11 and Server variants. Devices running any of these systems remain susceptible until an update is applied.

The CVSS score of 6.7 indicates a moderate severity local privilege escalation. No EPSS score is available, and the vulnerability is not yet listed in the CISA KEV catalog, suggesting limited public exploitation data. The attack vector is inferred to be local, relying on an authorized user’s ability to interact with the Storage Spaces Controller service. Successful exploitation would grant the attacker administrative or kernel-level privileges, potentially enabling full system compromise or persistence.