The vulnerability is an absolute path traversal in Windows Shell that allows an unauthorized attacker to perform spoofing with a physical attack. This flaw permits the attacker to manipulate specified paths in the shell environment, potentially enabling the attacker to act as or impersonate legitimate system components while in physical proximity.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 22H3; and Microsoft Windows Server editions 2008 R2 Service Pack 1, 2008 SP2, 2012, 2012 R2, 2016, 2019, 2022, the 23H2 edition, and 2025. These products are impacted across both x86 and x64 architectures where specified.

The risk is moderate with a CVSS score of 4.6 and an EPSS score indicating less than 1% probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to create a specially crafted path string in a Windows Shell session to trigger the path traversal, and the attack vector is inferred to be local or involve physical presence given the requirement for a physical attack in the description.