A heap‑based buffer overflow occurs in the Windows Kernel. An attacker who can execute code on the local system can trigger the overflow and gain SYSTEM level privileges. The vulnerability is a classic buffer overflow (CWE‑122) and would allow unauthorized modification of protected data, execution of arbitrary code, and full control of the affected machine.

Microsoft Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 for ARM64, 26H1 for ARM64; Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core). Versions are affected as listed by Microsoft under the CVE.

The CVSS score of 8.8 classifies this flaw as high severity, indicating that a successful exploit results in complete compromise of the local system. The EPSS score is not available, but the absence of a KEV listing suggests it is not widely exploited in the wild yet. The likely attack vector is local; an attacker running code with normal user privileges will need to construct a payload that targets the vulnerable heap region. Once the overflow is triggered, privilege escalation to SYSTEM is achieved, enabling full access to files, registry, and other system resources.