Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. The flaw is identified as CWE-122. Based on the description, it is inferred that the attacker must be locally authenticated to exploit the flaw.

The vulnerability affects multiple Microsoft operating systems, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions such as 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and server core installations).

The CVSS score of 7.8 indicates moderate to high severity. The EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because it requires local access, the attack vector is limited to users with local authentication or compromised local accounts. The flaw permits a local attacker to obtain higher privileges on the affected system if the vulnerability remains unpatched. Based on the description, it is inferred that the attack vector is local.