Improper access control in the Windows Storage VSP Driver permits an attacker who already has local access to elevate privileges. The flaw is an authorization bypass (CWE‑284) that allows escalation to a higher privileged user, thereby enabling the attacker to execute arbitrary code with system rights.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 22H3, 23H2, 24H2, 25H2, as well as all Server variants including Windows Server 2016, 2019, 2022, 2025 and their Server Core installations are affected.

The CVSS score of 7.8 indicates a high severity. The EPSS score of less than 1% shows a low probability of active exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are known. The likely attack vector is local and requires an attacker to be authorized on the host, but once compromised they can gain elevated privileges without additional conditions.