The vulnerability arises from an incorrect assignment of privileges within Windows Hello, enabling an unauthorized local attacker to tamper with Windows Hello functionality. This problem is classified as CWE-266, improper privilege management. If exploited, the attacker could alter or disable Windows Hello authentication, allowing higher privileges or unauthorized access. The impact is primarily local privilege escalation and tampering rather than remote code execution.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 22H3; Microsoft Windows Server 2016, 2019, 2022, 2025, including server core installations; these cover both client and server editions.

The CVSS score of 7.7 indicates high severity, yet the EPSS score is below 1%, reflecting a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread active exploits. The attack vector is likely local; an attacker must have physical or local system access to manipulate privilege levels. Given the present low exploitation probability, organizations should monitor for local tampering attempts and apply the available patch quickly.