The vulnerability lies in the way Windows Cryptographic Services stores sensitive data, allowing an attacker who has local access to manipulate that storage and obtain elevated privileges. This flaw is identified as CWE-922, indicating improper handling of privileged information, and could provide the attacker with full administrator rights when exploited.

Affected products include all listed Microsoft Windows 10 releases from Version 1607 through Version 22H2, Windows 11 releases such as 23H2, 24H2, 25H2, 22H3 and 26H1, and Windows Server editions from Server 2012 (including Server Core) up to Server 2025. These systems rely on a shared Cryptographic Services implementation that is vulnerable.

With a CVSS score of 7 the vulnerability is considered high severity, though EPSS data is unavailable and it is not listed in the CISA KEV catalog. The attack vector is local: an attacker must already possess some system access to read or alter the insecurely stored data and then trigger the cryptographic service to execute with elevated rights.