An improper resolution of symbolic links before file access in the Winlogon component allows an attacker who already has local authorization to gain higher privileges. The flaw, classified as CWE‑59, means the system may follow a link to an unintended file and perform operations with the user’s rights, which can lead to the execution of code or the acquisition of administrative capabilities on the same machine.

The vulnerability impacts various Windows operating systems, including Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server releases from 2012 through 2025, both in standard and Server Core editions.

The CVSS score of 7.8 indicates a moderate to high severity risk, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires local presence and authorization; thus an attacker must already have physical or remote console access. Because the flaw is local and requires privileged credentials, the overall likelihood of widespread exploitation remains limited, but the impact on an affected system can be significant if local admin privileges are compromised.