Improper input validation in Microsoft PowerShell enables an unauthorized user who can supply crafted input locally to bypass a security feature that is intended to restrict certain actions. The weakness follows the characteristics of input validation errors (CWE-20) and allows the attacker to exercise operations that the security policy is meant to block, thereby undermining the integrity of the intended controls.

Microsoft PowerShell releases 7.4 and 7.5 on Windows are affected. The advisory does not list specific patch levels, so all builds within those major releases are considered vulnerable.

The CVSS base score of 7.8 reflects a high severity vulnerability. Exploit probability data is not available, and the issue is not classified in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be local, requiring the attacker to feed malicious input to a PowerShell session. If successful, the attacker can bypass a security feature and potentially perform additional privileged actions within the scope of the user, representing a substantial risk in environments where PowerShell is run with elevated privileges.