The vulnerability is a heap-based buffer overflow in the Windows BitLocker service. An attacker who can send crafted input over the network can trigger the overflow and cause arbitrary code execution with elevated privileges. This flaw is identified as CWE‑122, which indicates a classic buffer overflow exploitation scenario.

Affected systems include Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1, as well as Microsoft Windows Server 2022 and 2025, including the Server Core installation of Windows Server 2025. The vulnerability may also apply to arm64 and x64 architectures as indicated by the CPE set. No specific patch level is listed, so all builds of these releases prior to the Microsoft update should be considered vulnerable.

The CVSS score of 9.8 reflects a high likelihood of remote exploitation. Although the EPSS score is currently unavailable, the lack of a listing in CISA's KEV catalog suggests no publicly exploited instances have been observed. Nevertheless, the flaw can be triggered by an unauthenticated attacker over a network connection, making it a significant risk for organizations that expose BitLocker services. The exploit requires the attacker to interact with the vulnerable BitLocker components and may necessitate a privileged context after the buffer overflow, but the exact prerequisites are not detailed in the available description.