The vulnerability involves the use of an uninitialized resource within the Windows Boot Manager, which can be exploited by an attacker who has physical access to the device. By manipulating this flaw, an attacker could bypass a security feature that is intended to protect the boot process. The weakness is classified as CWE-908, indicating a failure to properly initialize a resource that could lead to unintended behavior.

Affected versions include Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 22H3, 26H1), and Windows Server products from 2016 through 2025, including Server Core installations. The vulnerability applies across both x86 and x64 architectures as well as ARM64 for certain Windows 11 builds.

With a CVSS base score of 4.6, this issue falls into the medium severity range. No EPSS score is available, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The identified attack vector is physical—an adversary must be able to physically access the machine to leverage the flaw. Therefore, the risk is limited to environments where physical security controls are weak, and remediation through official Microsoft updates is the recommended course of action.