An improper resolution of symbolic links before accessing a file in the Winlogon process allows a local actor who can create or manipulate a link to cause Winlogon to follow the link and access sensitive files with elevated rights. By redirecting a link to a protected system file, the attacker can modify or replace critical components, effectively gaining administrative privileges on the machine.

The vulnerability affects multiple Windows desktop and server releases including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1; and a wide range of Windows Server editions from 2012 through 2025, encompassing both full installations and server core variations.

The base score of 7.8 categorizes this issue as high severity, yet the likelihood of exploitation is currently below one percent. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no widespread exploitation is known. The attack appears to be local only, requiring an authenticated user who can create symbolic links; remote exploitation is not documented.