The vulnerability arises from an incorrect privilege assignment in Windows Hello, allowing an attacker who can execute code locally to tamper with system components. This flaw is classified as CWE‑266, reflecting a weakness where a user can obtain elevated privileges. The resulting impact is Local Privilege Escalation, enabling malicious manipulation of system settings or installed applications, potentially compromising confidentiality, integrity, or availability of the affected device.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 22H3; and Microsoft Windows Server 2016, 2019, 2022, and 2025 (both full and Core installations). The affected versions are those listed in the CNA vendor/product table; no additional patch or version range information was supplied.

The CVSS score of 7.7 indicates a high severity for this flaw. The EPSS score of less than 1% suggests current exploitation likelihood is very low, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local; an attacker must already have local access to the system to exploit the privilege misassignment and perform tampering. No additional prerequisites or conditions are stated in the advisory.