This vulnerability, identified as CVE-2026-65672 and classified under CWE-122 (heap-based buffer overflow), exists in the Windows Remote Access API component of Microsoft Windows 11 version 23H2 (build 10.0.22631.0). It enables an attacker with local authorization to exploit the heap overflow to escalate privileges. The vulnerability has been assigned a CVSS v3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Microsoft has published an official fix to remediate this issue.

An authorized local attacker can exploit this heap-based buffer overflow to elevate privileges, potentially gaining higher-level access than intended. The vulnerability impacts confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 11 version 23H2 (build 10.0.22631.0) as soon as possible to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65672 for detailed patch information and guidance.