The vulnerability arises from improper authentication within Windows Storage, allowing an attacker who already has local access to lift their privileges to a higher level. This flaw is a classic example of CWE‑287 and CWE‑426, where inadequate credential checks and potential untrusted search path issues combine to enable privilege escalation. An attacker could thereby gain administrative rights, modify system files, and potentially compromise the entire operating environment.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, 22H3, 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both standard and Server Core installations.

The CVSS base score of 7 indicates moderate to high severity. The EPSS score is less than 1%, suggesting a low current exploitation probability, and the issue is not listed in the CISA KEV catalog. The flaw requires local, authorized access; it does not permit remote exploitation, but any user with existing privileges can abuse the weakness to elevate their own rights.