The vulnerability arises from an integer underflow in the Windows Storage Spaces Controller. An authorized local attacker could exploit this wraparound behavior to gain higher privileges than they originally possessed. The exploitation compromise results in elevation of privileges on the affected system, potentially allowing the attacker to modify system settings, bypass restrictions, and execute arbitrary code with elevated rights. The weakness corresponds to CWE-191, which signifies integer wrapor underflow problems.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; Windows Server 2022 23H2 Edition (Server Core installation); Windows Server 2025 and its Server Core installation. All affected configurations are present within the listed product releases. The vulnerability affects the Storage Spaces component across those platforms.

The CVSS score of 7.8 indicates a medium‑to‑high severity of the flaw, while EPSS data is unavailable. The attack vector must be local and requires an attacker to be authenticated on the target machine. Because it grants local privilege escalation, the impact is significant if the attacker already has a foothold. The flaw is not part of the CISA KEV catalog, so there are no publicly known active exploits reported at the time of disclosure. Nevertheless, the attack surface remains high for any user who can gain legitimate local access to a system running one of the affected Windows releases.