The vulnerability arises from insufficient granularity in Microsoft Defender's access control, enabling an attacker with legitimate local access to elevate privileges to higher levels. This flaw, identified as CWE-1220, can lead to unauthorized execution of actions that require elevated rights, potentially compromising the entire system. The impact is local privilege escalation, permitting the attacker to exploit system resources, modify configuration, or install malware.

All installations of Microsoft Defender Antimalware Platform, including Windows Defender, are affected unless they have already applied the security update referenced in the Microsoft Advisory. Developers should verify the Defender version and apply the latest update. The workaround is not specified by Microsoft.

The CVSS score of 7.8 marks this as a high impact vulnerability, while an EPSS score of 3% indicates a modest probability of exploitation in the wild. With this vulnerability listed in the CISA Known Exploited Vulnerabilities catalog, security teams should treat it as a confirmed threat. The attack requires an authorized local user and bypasses the platform’s granular access controls, allowing the attacker to elevate privileges. No public vulnerability exploitation string has been publicly disclosed beyond the advisory, but the KEV listing demonstrates that exploitation has already occurred.