A trust boundary violation in the Windows Device Health Attestation framework allows an attacker who already has local user access to obtain elevated privileges. The CVE description notes an authorized attacker can elevate locally, implying the flaw is exploitable by users who can run code on the affected system. The vulnerability is classified as CWE‑501, indicating a misconfiguration that permits unauthorized access to protected resources.

The vulnerability impacts a wide range of Microsoft Windows operating systems: Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server releases 2016, 2019, 2022, and 2025, including both standard and Server Core installations. The affected systems utilize the Device Health Attestation service, and systems with this feature enabled are susceptible.

The CVSS v3 score of 7.8 indicates a high severity and a potential for significant impact. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation at present. However, because the attack is local, any user or malware that gains foothold on the machine can leverage the flaw to elevate privileges, compromise system integrity, and potentially gain access to sensitive data across the endpoint.