A heap-based buffer overflow in the Microsoft Scripting Engine permits an attacker with local authority to gain elevated privileges. The flaw occurs when a malicious script manipulates memory on the heap, allowing the attacker to overwrite critical data structures and execute arbitrary code in the context of the elevated process. The vulnerability is categorized under CWE‑122, representing a classic buffer overflow weakness that can lead to privilege escalation and unauthorized system modification.

The affected operating systems are Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core editions. The issue spans x86, x64, and arm64 architectures where applicable.

The CVSS score of 7.8 denotes a moderate to high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires an authorized local user to execute a crafted script that triggers the heap overflow; remote exploitation is not described. Exploitation would grant local administrator privileges, enabling the attacker to install software, modify system configuration, and potentially pivot to broader network access.