The vulnerability is a heap‑based buffer overflow in the Windows Program Compatibility Assistant Service that lets an attacker with local access elevate privileges. By exploiting the overflow, the attacker can gain higher privileges on the affected system, potentially enabling full system compromise.

The flaw affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; as well as Windows Server 2016, Server 2019, Server 2022, and Server 2025, including their Server Core installations, on x86, x64, and arm64 architectures.

The CVSS score of 7.8 indicates a high impact, while the EPSS score is not available, suggesting limited public exploitation data. The vulnerability does not appear in CISA's KEV list. Attackers would need local privileges to interact with the service, and the flaw requires an authorized user to trigger the overflow. Once exploited, the attacker can raise privileges, enabling broader compromise. The presence of a publicly available update mitigates the risk if applied promptly.