The vulnerability enables an attacker who has authorized access to traverse the file name or path used by the Windows Telephony Service, leading to elevation of privileges. This weakness (CWE‑73) permits an attacker to gain higher or system level permissions over an adjacent network segment, potentially allowing the execution of arbitrary code or modification of system settings.

Affected systems are Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, and 25H2; and the Windows Server product line including Server 2008 R2 Service Pack 1, Server Core installations, Server 2008 Service Pack 2, Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, Server 2025 and their Server Core editions. No specific sub‑versions beyond those listed are known to be vulnerable, but all listed build numbers must be addressed.

The CVSS score of 8.0 marks this as a high‑severity issue. The EPSS score is < 1 %, indicating that the probability of real‑world exploitation is currently low, and the vulnerability is not in the CISA KEV catalog. The likely attack vector requires an attacker who is already authenticated or otherwise authorized on the system, but can exploit the privilege escalation over a nearby network. Successful exploitation would allow the attacker to run arbitrary code with elevated privileges, threatening confidentiality, integrity, and availability of network resources.