The vulnerability is a race condition in the Function Discovery Service DLL that allows an authorized local attacker to gain a higher privilege level. Based on the description, it is inferred that the service, when accessed concurrently by multiple processes, fails to implement proper synchronization, enabling execution of code with elevated privileges, potentially giving the attacker administrative access to the affected system.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; Microsoft Windows Server 2012, Server 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 Edition, including Server Core installations where applicable.

Based on the description, the likely attack vector is local access with concurrent execution of the Function Discovery Service. The CVSS score of 7 indicates a high severity risk, and the EPSS score of 1% shows a low but nonzero likelihood of exploitation, with the vulnerability not listed in the CISA KEV catalog. Because the issue requires concurrent execution of a shared resource, the exploitation requires some technical expertise but does not need remote access. If the attacker already has authorized access, they could trigger the race condition to elevate privileges and may subsequently gain full administrative control over the machine.