The vulnerability is a heap‑based buffer overflow in the Windows Bind Filter Driver, which can be exploited by an attacker who already has local access to the system. Successful exploitation elevates the attacker’s privileges, allowing them to perform privileged actions such as modifying system settings or installing malware. The weakness corresponds to CWE‑122, a classic heap overflow that compromises memory integrity.

Microsoft Windows 10 Versions 1809, 21H2, and 22H2; Windows 11 Versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2019, Server 2022, and Server 2025, including their Server Core installations.

The CVSS score of 7.8 indicates a high severity for local privilege escalation. No EPSS data is available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no publicly known exploits yet. However, because the attack vector requires local authorized access, the risk remains significant for users who run privileged applications or share a computer with untrusted users. An attacker would need to identify the driver’s heap vulnerability, trigger the overflow to gain a higher privilege level, potentially taking control of the system.