The vector for this vulnerability is local.
While performing the conversion, the original buffer’s correct length is used causing the write to continue out of bounds. The function then goes on and performs a binary to ASCII hex conversion, writing the ASCII hex characters to this buffer.
An error exists within cng!CfgAdtpFormatPropertyBlock where buffer is allocated from a value that is truncated to be 16-bits.
