A heap-based buffer overflow exists in the Windows Storage Port Driver that permits an unauthorized attacker to elevate privileges when the attacker has physical access to the affected system. This flaw falls under the buffer overflow weakness category (CWE-122) and can lead to escalation from a non‑privileged user to a privileged user on the machine.

Affected systems are Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1) and Windows Server 2025, including Server Core installations. All listed variants are impacted by the same flaw in the Storage Port Driver.

The vulnerability is rated a CVSS score of 6.8, indicating moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, suggesting it is not currently a widely exploited public vulnerability. Because the attack requires physical access and exploitation of a heap-based overflow, the risk is primarily confined to environments where physical security is inadequate. Nonetheless, the potential to gain elevated privileges warrants prompt assessment and mitigation.