Improper input validation in Microsoft Azure Attestation Service and Device Health Attestation Service permits an authorized attacker to perform spoofing by providing malicious data during a physical attack. The flaw allows an attacker to forge attestation responses, potentially causing systems to accept counterfeit or malicious workloads as trusted. The vulnerability is categorized as CWE‑20, indicating uncontrolled input that may be used to bypass validation logic. No capability for remote exploitation is mentioned; the attacker must be authorized and have some level of local or physical access to the affected system.

Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025), across multiple processor architectures including x86, x64, and ARM64. The vulnerability is reported to affect both client and server editions, including Server Core installations.

The CVSS score of 3.9 indicates low overall severity. EPSS is not available, suggesting no data on current exploitation likelihood. The issue is not listed in the CISA KEV catalog. The likely attack vector requires an authorized attacker with local or physical access, making direct exploitation less probable in typical high‑security environments. Nonetheless, spoofing of attestation services could undermine integrity checks and enable the execution of malicious code that is mistakenly trusted by the system.