A heap-based buffer overflow occurs in the Windows Resume feature, allowing a local attacker with authorized access to execute arbitrary code during the session restoration process. The flaw is classified as CWE‑122 and can be used to elevate privileges on the affected system, potentially giving the attacker full control over the machine.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; Microsoft Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022 and Server 2025, including Server Core installations.

The vulnerability carries a CVSS score of 7.8, indicating moderate to high severity; however, the EPSS score is not available, and it is not listed in CISA’s KEV catalog. The attack vector is local, requiring the attacker to be authorized on the target machine or to access a session that triggers Resume. Given the potential to execute code with the current user’s privileges, the risk is significant for systems where the Windows Resume feature is enabled and unpatched.