## Summary
CVE-2026-24283 is a heap-based buffer overflow in Windows File Server that can allow an authorized local attacker to elevate privileges. The issue is classified as CWE-122 and has a high CVSS score of 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
## Technical Details
- Vulnerability type: heap-based buffer overflow (CWE-122).
- Affected component: Windows File Server (per NVD description).
- Attack characteristics (per NVD): local attack vector (AV:L) with low complexity (AC:L) and required privileges (PR:L), with no user interaction (UI:N).
## Affected
- Microsoft Windows 11 24H2 < 10.0.26100.7979
- Microsoft Windows 11 25H2 < 10.0.26200.7979
- Microsoft Windows 11 26H1 < 10.0.28000.1719
- Microsoft Windows Server 2022 23H2 < 10.0.25398.2207
- Microsoft Windows Server 2025 < 10.0.26100.32463
## Impact
- Local privilege escalation is possible via memory corruption in Windows File Server.
- Expected security impact includes high confidentiality, integrity, and availability impact (C:H/I:H/A:H) with scope change (S:C).
## Mitigation
1. Patch immediately to versions at or above the fixed build thresholds listed under Affected.
2. Restrict local access to File Server systems to reduce the chance of an authorized attacker reaching the vulnerable code path.
3. Monitor for suspicious local activity consistent with privilege escalation attempts (exact indicators not available from provided references).
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-122