A flaw in deserializing untrusted data within Microsoft HPC Pack 2019 can be triggered by an authorized local user to gain elevated privileges. The vulnerability is tied to input validation failures, reflected in CWE‑502. If successful, the attacker may obtain higher system access, enabling further compromise. The impact is confined to the host where HPC Pack is installed.

Microsoft HPC Pack 2019 is the affected product, as identified by the CNA. No specific sub‑versions are listed, so all installations of 2019 are considered vulnerable.

The CVSS score of 7.8 indicates a high risk of potential damage. With no EPSS data available, the public exploitation likelihood is unknown, but the vulnerability is not marked in the KEV catalog. Since the flaw requires an authorized user and local access, the attack vector is likely local. An attacker who can submit arbitrary data to the deserialization process can elevate privileges and gain control over the affected system.