A heap‑based buffer overflow in the Windows Distributed File System (DFS) service permits an attacker with local access to elevate privileges. By supplying crafted data, the overflow can modify memory structures inside the DFS process, allowing code execution with higher rights. This classic buffer overflow weakness (CWE‑122) exposes the system to unauthorized privilege escalation.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations.

The CVSS score of 6.7 indicates a moderate severity vulnerability; the EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Because the attack vector requires local access to the DFS service, an attacker must already have some level of authorized access to exploit the buffer overflow. If successful, the attacker could gain elevated privileges on the compromised host, potentially enabling broader system compromise. Consequently, the risk is moderate but still warrants timely remediation.