The vulnerability is an improper resolution of path equivalence within the Windows SmartScreen feature. This flaw allows an attacker who can send crafted traffic over a network to cause SmartScreen to incorrectly evaluate a file or URL as safe. The result is that malicious content can be downloaded or executed without triggering the user‑facing warning, effectively bypassing a key defense that protects users from known and unknown threats. This can lead to compromised systems and may serve as a foothold for further exploitation.

Windows 11 24H2, Windows 25H2, Windows 26H1, and Windows 26H2 for ARM64-based systems are affected. The flaw is present across all listed versions, making a broad set of devices susceptible.

The CVSS score of 8.8 indicates a high severity. While the EPSS score is not available, the absence of a low EPSS value does not preclude exploitation in targeted attacks. The vulnerability is not currently listed in the CISA KEV catalog, implying that publicly known exploits are not documented, but the path‑traversal weakness can be leveraged by remote users with network access. The likely attack vector involves sending a crafted request that manipulates path equivalence, thus allowing the bypass. The weakness is a classic path traversal (CWE‑41) that can be exploited without user interaction if the remote attacker can influence network traffic processed by SmartScreen.