This vulnerability is a local privilege escalation that occurs when Winlogon resolves a symbolic link before performing file access. An attacker who can create or modify a link that points to a protected system file can cause the Winlogon process to follow the link, allowing the attacker to read or write files with elevated privileges. The weakness is classified as CWE‑59, reflecting improper restriction of operations on a resource.

The vulnerability affects multiple Windows desktop and server releases, including Windows 10 releases from version 1607 through 22H2, Windows 11 releases from 22H3 through 26H1, and Windows Server editions from 2012 through 2025, covering both full installations and server‑core variations. All listed operating system versions are impacted as described by Microsoft.

The CVSS score of 7.8 marks this as high severity, and the EPSS score of 3 % indicates a moderate likelihood of exploitation. Currently the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation is known. The attack requires local, authenticated access and the ability to create or modify symbolic links; remote exploitation is not documented.