The vulnerability is a deserialization flaw in Windows System Image Manager that allows an attacker with local authorization to execute arbitrary code. This flaw is classified as CWE‑502 and, if exploited, would enable the attacker to run code with the permissions of the user, potentially compromising system integrity and allowing further lateral movement.

The flaw affects Microsoft Windows ADK for Windows 10 version 2004, Windows 11 versions 22H2, 23H2, 24H2 and Windows Server 2022 ADK. It also includes Windows 10 ADK 2004 and Windows Server 2022 ADK. Any installations of these components are susceptible.

With a CVSS score of 7.8 the vulnerability is of moderate‑high severity. The EPSS score of below 1% indicates low likelihood of exploitation, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be local; an attacker must be authorized on the system to exploit it. In the absence of a remote vector, the vulnerability presents a significant risk to systems that run the affected ADK components.