The vulnerability is a heap-based buffer overflow located in the Windows PCI Bus Driver. When an attacker can manipulate input data sent to the driver, the overflow allows the attacker to write arbitrary data to the heap, resulting in the ability to execute code with the privileges of the driver. The direct consequence is that a local user with authorized access to the affected system can elevate their privileges to system level, compromising the entire operating environment.

Affected Microsoft products include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2019, 2022, and 2025. These iterations run on x86, x64, or arm64 architectures depending on the specific build.

The CVSS score of 8.8 indicates a high severity risk. Because EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the exploitable risk is primarily based on the high severity score. The likely attack vector is local: an attacker must gain authorized or privileged user access to the system to trigger the heap overflow. Successful exploitation would grant full system privileges, enabling the attacker to take over the machine, install malware, or exfiltrate data.