The vulnerability stems from an incorrect permission assignment on ATBroker.exe, a component of the Windows Accessibility Infrastructure. An attacker who already has authorized local access can exploit this flaw to elevate privileges. The potential impact is that the attacker could gain elevated rights, enabling them to bypass normal security controls, install malware, or modify system settings. The weakness is categorized as CWE‑732: Incorrect Permission Assignment.

Affected systems comprise Microsoft Windows 10 (builds 1607, 1809, 21H2, 22H2), Windows 11 (builds 23H2, 24H2, 25H2, 26H1, 22H3) and the corresponding Windows Server releases: 2012, 2012 R2, 2016, 2019, 2022, 2025, and their Server Core variants. These versions are impacted across both 32‑bit, 64‑bit, and ARM64 architectures as reflected in the cited CPE listings.

This issue carries a CVSS score of 7.8, indicating high severity, while the EPSS score is below 1 %, suggesting a low likelihood of active exploitation at this time. The vulnerability is not in the CISA KEV catalog, and it requires a local attacker with some level of authorized access; remote exploitation is not demonstrated. Organizations should therefore treat this as a high‑importance patchable vulnerability, especially for systems that might be exposed to users with administrative or elevated rights.