The vulnerability is an integer underflow in the Windows Common Log File System Driver that permits a local attacker with sufficient access rights to gain elevated privileges. As a result, the attacker can execute code or alter system configuration with higher privileges, potentially compromising confidentiality, integrity, and availability of the affected system. This underflow can be triggered by manipulating log data that the driver processes, leading to a wraparound that results in unauthorized memory access or privilege escalation.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025, and 23H2 Edition. All vulnerable releases are those that ship the pre‑update Common Log File System Driver without the fix.

The CVSS score of 7.8 indicates high severity, but the exploitation probability (EPSS) is not available, so the likelihood is uncertain. The vulnerability is not listed in CISA KEV, implying no documented public exploitation as of the latest data. The attack vector is local and requires an authorized user or privileged process to emulate the conditions that trigger the underflow, suggesting that the threat profile is limited to users with existing local access.