An improper resolution of symbolic links before file access in the Winlogon component allows an authorized local attacker to gain elevated privileges. The weakness, classified as CWE‑59, enables the system to follow a link to an unintended file and perform operations with the user’s rights, which can lead to execution of code or acquisition of administrative capabilities on the same machine.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1; Microsoft Windows Server 2012 (including Server Core), 2012 R2 (including Server Core), 2016, 2019, 2022, 2025 (including Server Core).

The CVSS score of 7.8 indicates a high severity, while the EPSS score of 3 % suggests a moderate likelihood of exploitation. The vulnerability requires a local attacker who already has adequate permissions; no remote attack surface is described. Exploitation typically involves manipulating a symbolic link that Winlogon resolves before accessing the file, potentially allowing execution with elevated privileges.