A flaw in deserializing untrusted data within Microsoft HPC Pack 2019 can be triggered by an authorized local user to gain elevated privileges. The vulnerability is tied to input validation failures, reflected in CWE‑502. If successful, the attacker may obtain higher system access, enabling further compromise. The impact is confined to the host where HPC Pack is installed.

Microsoft HPC Pack 2019 is the affected product, as identified by the CNA. No specific sub‑versions are listed, so all installations of 2019 are considered vulnerable.

The CVSS score of 7.8 indicates a high risk of potential damage. The EPSS score of 2% suggests a low to moderate likelihood of exploitation, and the vulnerability is not listed in the KEV catalog. Since the flaw requires an authorized user and local access, the attack vector is likely local. An attacker who can submit arbitrary data to the deserialization process can elevate privileges and gain control over the affected system.