This critical heap-based buffer overflow vulnerability in Microsoft Windows is currently being exploited in the wild, posing a severe risk of unauthorized privilege escalation.

This vulnerability involves a heap-based buffer overflow within the Windows Advanced Local Procedure Call (ALPC) subsystem, which can be triggered by an authenticated local attacker to gain elevated privileges.

The vulnerability carries a CVSS score of 9.5, reflecting its potential for total system compromise when exploited by a local user. Successful exploitation allows an attacker to bypass security boundaries, potentially leading to full administrative control, data theft, or persistence on the affected host. Given its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, the urgency of this remediation is extreme.

Immediate Action: Apply the vendor-provided security updates immediately to the affected Windows builds as listed in the Microsoft Update Guide.

Proactive Monitoring: Monitor system logs for unusual ALPC activity or suspicious processes attempting to execute with elevated privileges.

Compensating Controls: Since this is a local privilege escalation, ensure that endpoint detection and response (EDR) solutions are active to identify and block post-exploitation behaviors.

Public Exploit Available: Unknown

Due to confirmed active exploitation and the critical nature of the ALPC subsystem, organizations must prioritize patching these systems immediately. Failure to address this vulnerability allows attackers who have already gained initial low-level access to escalate their permissions to the highest level, effectively compromising the entire system. Please verify deployment of the provided fixed versions against your current inventory to ensure full coverage.