A protection mechanism failure in the Windows Mark of the Web (MOTW) feature allows an unauthorized attacker to trick the operating system into treating content from a network source as trusted. This bypass removes the safety guard that normally tags downloaded files with an alternate data stream indicating they came from the internet, reducing the system’s ability to guard against malicious files. The weakness is classified as CWE‑693 and could enable an attacker to deliver files that the OS will not warn about or disallow from execution, exposing the system to compromise.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H1; Windows Server 2012 R2, 2016, 2019, 2022 and 2025, including server core installations.

The CVSS score of 5.4 indicates a moderate severity level. EPSS data is absent, and the vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploitation at this time. Based on the description, the likely attack vector is over the network, where a malicious actor delivers a file that the operating system mistakenly treats as safe. The risk is therefore moderate but could be higher if an attacker successfully delivers executable content that bypasses MOTW. Implementing the official Microsoft update mitigates the vulnerability.