The vulnerability is a type‑confusion flaw in the Windows StateRepository API that permits an attacker with local authorization to elevate privileges. The flaw occurs when a resource is accessed using an incompatible type, allowing the attacker to trigger privileged operations that normally require elevated rights. Because this is a local privilege escalation, the potential impact is full control over the affected Windows system, enabling the attacker to install malware, access sensitive data, or modify system configurations.

Microsoft Windows 10 and 11 from version 1607 through 26H2, inclusive, and all associated 64‑bit builds, as well as Microsoft Windows Server from 2012 to 2025. All included editions – regular, server core – are affected. The specific CPE strings in the advisory indicate that every mainstream Windows desktop and server release in this range may be vulnerable unless patched.

The CVSS score of 7.8 indicates a high severity local privilege escalation with moderate complexity and requiring user interaction. The EPSS score is not provided, so the current exploit probability is unclear, but the lack of a CISA KEV listing suggests that no widespread public exploits have yet been confirmed. The likely attack vector is a local attacker who has some form of privileged or authenticated access to the system; the exploit requires the attacker to invoke the StateRepository API with an inappropriate type. If successfully executed, the attacker would gain higher privileges on the same host.