The vulnerability arises from insufficient granularity in Microsoft Defender Antimalware Platform's access control, allowing an attacker with legitimate local access to elevate privileges to higher levels. The flaw, identified as CWE-1220, can enable unauthorized execution of actions that require elevated rights, potentially compromising the entire system. This local privilege escalation permits an attacker to modify configurations or install malware once the higher privileges are obtained.

All installations of Microsoft Defender Antimalware Platform are affected unless they have already applied the security update referenced in the Microsoft Advisory. No other vendors or products were indicated as impacted in the CNA data.

The CVSS score of 7.8 classifies this as a high-impact vulnerability, and the EPSS score of 6% indicates a moderate probability of exploitation in the wild. It is listed in the CISA Known Exploited Vulnerabilities catalog, which confirms that exploitation has occurred. The likely attack vector is an authorized local user bypassing the platform’s granular access controls to elevate privileges. (Based on the description, it is inferred that the attacker must have local access to exploit this flaw.)