A heap-based buffer overflow flaw exists within the Windows WebDAV protocol stack. When triggered by an attacker with authorized access to the affected system, the overflow can be abused to overwrite critical memory structures and execute arbitrary code with elevated privileges. This vulnerability is identified as CWE-122, indicating potential out-of-bounds writes. The impact of successfully exploiting it is the elevation of user rights on the local machine, enabling the attacker to run software with higher privileges, access sensitive data, and potentially disrupt system operation.

The flaw affects numerous Microsoft Windows environments. Operating systems impacted include Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1. Server editions also are affected: Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both standard and Server Core installations. Both x86 and x64 architectures, as well as arm64-based systems, are susceptible where WebDAV is enabled.

The assigned CVSS score of 7.8 denotes a high risk severity, reflecting significant privilege escalation potential. EPSS data is currently unavailable, so the likelihood of exploitation in the wild cannot be precisely quantified, but the absence from CISA’s KEV list indicates no known widespread exploitation to date. The attack vector is inferred to be local: the attacker must have authorized access to the target machine and must be able to send crafted WebDAV requests. Successful exploitation would allow local code execution and privilege inflation on the compromised system.