The vulnerability arises from improper link resolution before file access in the Windows Backup Engine. A local user with sufficient privileges can craft a malicious symbolic or junction link that the engine resolves without proper checks, allowing the attacker to overwrite or create files owned by the system or a higher‑privileged user. This elevates the attacker’s privileges within the local session, potentially granting administrative capabilities on the device. The weakness corresponds to CWE‑59 and carries a CVSS score of 7, indicating a medium‑to‑high severity for local attackers.

The flaw affects multiple releases of Windows 10 and Windows 11, specifically Windows 10 21H2 and 22H2, as well as Windows 11 23H2, 24H2, 25H2, 26H1, and 26H2. Both x86, x64, and arm64 architectures are impacted as listed by Microsoft. These versions are identified by the vendor’s official product naming and the associated CPE entries for each architecture.

With no network attack vector reported, the exploit requires a user to have local access and write permissions to a directory monitored by the backup engine. The EPSS score is not available but the CVSS of 7 signals a significant exploitation potential. The vulnerability is not yet in the CISA KEV catalog, suggesting no known large‑scale deployment yet. Nonetheless, any local attacker who can execute code will likely succeed in privilege escalation using the unvalidated link resolution.