A flaw in the Windows Kernel allows an authorized local user to influence the file name or path used by kernel code. This external control, identified as CWE‑73, enables the attacker to elevate privileges and gain higher access rights on the affected machine. The vulnerability can be leveraged to execute privileged actions, tamper with system settings, or establish persistence, potentially compromising the integrity and availability of the system.

Microsoft Windows 10 builds 1809, 21H2, and 22H2; Windows 11 builds 22H3, 23H2, 24H2, 25H2, and 26H1; Windows Server 2019, Server 2022 (including Server Core and the 23H2 Edition), and Server 2025 (including Server Core). All configurations listed by the CNA are vulnerable.

The CVSS score of 7.8 indicates high severity, while an EPSS score of less than 1% suggests a low probability of current exploitation. The vulnerability is not included in CISA’s KEV catalogue. Based on the description, the attack vector is local: an attacker who can specify a file path or name on the system can exploit the kernel to elevate privileges. No remote exploitation or network prerequisites are noted in the available data.