The vulnerability is a heap-based buffer overflow in the Windows kernel that can be triggered by a locally authenticated attacker. Exploitation would allow the attacker to execute code in kernel mode, granting full control of the system and compromising confidentiality, integrity, and availability for the affected account. The flaw is classified as CWE-122.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2; and Microsoft Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both normal and Server Core installations.

The CVSS score of 7.8 indicates a high severity threat. The EPSS score is less than 1 %, suggesting a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. The attack vector appears to be local, requiring the attacker to have some level of authorized access on the target system to trigger the kernel heap overflow. If successfully exploited, the attacker would obtain privileged, kernel‑level access and full system control.