The vulnerability in the Windows Projected File System is caused by a race condition that arises when multiple processes access a shared resource without proper synchronization. An attacker who already has local user privileges can exploit this flaw to elevate their own privileges on the same system, potentially gaining administrative rights or executing privileged code. The defect lies in the handling of file system operations, allowing the circumvention of permission checks.

Affected systems include Microsoft Windows 10 versions 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1. The server editions of Windows Server 2019, 2022, 2025, and the 23H2 edition are also impacted. All affected releases depend on the Windows Projected File System component, whether in a full desktop or a Server Core deployment.

The CVSS score of 7.8 classifies this issue as high severity. Although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the attack vector is local and requires the attacker to be authenticated on the target machine. Once the race condition is triggered, privilege escalation can be achieved without remote code execution or network-based exploitation, exposing the system to full administrative takeover.