Host Process for Windows Tasks contains an improper link resolution before file access error, enabling an attacker who can run a local user context to acquire higher privileges through the host process. The flaw represents a classic path traversal weakness (CWE‑59) where a manipulated file path is followed to a system resource. If exploited, the attacker can execute operations with system level rights, compromising the confidentiality, integrity, and availability of the affected machine.

The vulnerability affects Microsoft Windows 11 versions 24H2 and 25H2, as well as the forthcoming Windows Server 2025 and its Server Core installation. The affected component is the host process that manages scheduled tasks.

The CVSS score of 7.8 indicates a high severity, and the EPSS score of 30% suggests a moderately high likelihood of exploitation. The vulnerability is listed in the CISA KEV catalog, confirming known exploitation activity. Local privileged users could trigger the flaw with little reconnaissance, making the attack vector likely to be local.