A heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) permits an authorized local attacker to acquire higher privileges. The flaw arises from inadequate bounds checking of incoming data during SSTP processing, identified as CWE‑122. The resulting escalation can enable a compromised user to gain administrator level access, potentially allowing full control over the infected machine and compromising network integrity.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2012 R2 through 2025, including core and standard installations, all of which are impacted by this vulnerability.

The CVSS score of 7.8 signifies a high severity local privilege escalation. EPSS is not available and the vulnerability is not listed in CISA KEV, implying no documented active exploitation so far. Exploitation requires that an attacker already has authorized local access to a system where SSTP is enabled, making this a local rather than remote attack. Systems running the aforementioned versions of Windows 10, Windows 11, or any of the listed Windows Server releases with SSTP enabled constitute the risk surface.