This vulnerability arises from improper link resolution before file access in Windows Collaborative Translation Framework (CTFMON). An attacker with local user privileges can manipulate link handling to access files in a way that bypasses normal access controls, leading to local privilege escalation. The weakness is classified as CWE-59, indicating unsafe handling of relative or symbolic links.

Affected Windows operating systems include Windows 10 from version 1607 through 22H2, Windows 11 from versions 23H2 through 26H1, and Windows Server editions spanning 2012, 2012 R2, 2016, 2019, 2022, and 2025. The impact applies to both x86 and x64 architectures as listed in the CNA version details.

The CVSS score of 7.8 reflects a high severity for local privilege escalation. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread automated exploitation. Attack attempts require a local authenticated presence, and the attacker can exploit the vulnerability by invoking CTFMON or related components that perform link resolution, thereby increasing privileges on the compromised machine.