An improper link resolution before file access in the Universal Plug and Play component (upnp.dll) enables a local, authorized user to trigger the program to follow a crafted link that points to a protected file, revealing data that should have been restricted. This flaw represents a combination of privilege escalation and path traversal weaknesses.

The vulnerability affects a wide range of Microsoft Windows desktop and server releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; and Windows Server editions from 2012 through 2025, with both standard and Server Core configurations.

The CVSS score of 5.5 indicates moderate severity. Exploitation requires a local attacker with authorization and the UPnP service running; there is no evidence of remote exploitation. EPSS and KEV listings are not available, suggesting limited public exploitation. Consequently, the risk is confined to local users who can gain write access to privileged files via the vulnerable link resolution logic.