The vulnerability arises from an untrusted pointer dereference in the Windows Sensor Data Service. This flaw allows an attacker with local privileges to exploit memory handling errors and gain elevated privileges. The weakness involves improper input validation (CWE‑20) and unsafe pointer handling (CWE‑822), enabling an attacker to execute arbitrary code or modify system state.

Affected systems include several Microsoft Windows client and server releases. Clients such as Windows 10 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, 22H3, and 26H1 are vulnerable. Server editions impacted are Windows Server 2019, Windows Server 2022, and Windows Server 2025, all versions listed in the CNA vendor product list.

The CVSS base score of 7.8 indicates a high severity for local privilege escalation. No EPSS score is available, and the vulnerability is not cataloged in CISA’s KEV list, suggesting it has not yet been widely exploited in the wild. The attack vector is local, requiring an authorized user to execute crafted input against the Sensor Data Service. Once exploited, the attacker can gain elevated system privileges.