The vulnerability allows a user who already has local access to subvert the Windows Secure Boot security mechanism. By bypassing Secure Boot, an attacker can load unsigned or malicious firmware or drivers during system startup, potentially granting elevated privileges or persistence. This weakness is classified as CWE‑299, an authorization bypass that undermines the integrity of the boot process. The impact is limited to systems where the attacker has physical or authorized local access, but it can enable a local adversary to execute arbitrary code during boot and compromise the system’s trusted computing base.

Affected are Microsoft Windows 10 operating systems from Version 1607 to 22H2 and all Windows 11 releases from 23H2, 24H2, 25H2, 26H2, and 26H1, including both x64 and arm64 platforms. The vulnerability also impacts Windows Server 2016 (full and core), 2019 (full and core), 2022, and 2025 (full and core) editions. ARM64‑based systems are affected for Windows 11 23H2, 24H2, 25H2, and 26H2, as listed in the CNA data.

The CVSS score is 4.4, reflecting a moderate risk that depends on local privileged compromise. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploits in the wild as of the latest data. The attack vector is inferred to be local since the description states an authorized attacker can bypass the feature. Exploitation requires authorizing the victim’s machine to load unsigned components during boot, which would give the attacker full control over that system after compromising it locally.