The vulnerability is a time‑of‑check to time‑of‑use race condition in Windows Modern Device Management (MDM). An attacker with local, authorized access can exploit the race to gain higher privileges on the system, potentially allowing full control of the machine. The weakness is classified as CWE‑367, indicating that proper synchronization is missing, leading to privilege escalation.

Microsoft products are impacted, including Windows 10 Version 1809, 21H2, 22H2; Windows 11 Versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2019, 2022, and 2025, both standard and Server Core editions. These versions are listed by Microsoft in the advisory and match the CPE entries provided.

The CVSS score of 7 indicates a high severity risk. EPSS information is not available, so the exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, which suggests no known exploitation in the wild as of now. The practical attack vector requires local authorized access; however, once obtained, the privilege escalation can lead to full system compromise. Due to the lack of a public exploit, the immediate risk is moderate to high for systems where MDM is enabled and local users have elevated rights.