The vulnerability manifests as an out‑of‑bounds read within the Windows Encrypting File System (EFS) code. An attacker who already has local access can trigger the read flaw and, as a result, gain elevated privileges on the affected machine. The flaw is classified as CWE‑125, a classic buffer overread condition that can be leveraged to bypass intended permission checks.

Microsoft Windows 10 versions 1809, 21H2 and 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2, 25H2 and 26H1; Microsoft Windows Server 2019, 2022 and 2025 including their Server Core installations. All listed editions contain the affected component and are vulnerable prior to the Microsoft patch.

The CVSS score of 7.8 indicates a high severity rating. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been broadly exploited. Attackers need local, authorized privileges to push the read error; therefore the attack vector is inferred to be local rather than network based. Nonetheless, because local privilege escalation can lead to system compromise, the risk is considered high for environments where users have file system access to EFS protected data.