The vulnerability is a missing authentication check in the Windows Remote Desktop Licensing Service. Because the service fails to verify the caller, an attacker who already has local access can invoke a privileged operation and gain higher privileges. This can allow the attacker to modify system settings, install malware, or compromise other processes with elevated rights. The weakness corresponds to CWE‑306, a missing authentication for a critical function.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 22H3 and 26H1; and Microsoft Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025 and the 23H2 edition, including their Server Core installations.

The CVSS score of 7.8 indicates a high risk for local privilege escalation. No EPSS score is available and the vulnerability is not listed in the KEV catalog, but because the flaw allows an authenticated local user to gain elevated privileges, it can be exploited easily on systems with the affected configurations. The attacker requires only local privileges to trigger the flaw, and no remote network access is necessary.