The vulnerability is a protection mechanism failure in Windows Secure Boot that allows an authorized attacker to bypass a security feature locally. Because Secure Boot is designed to verify that the firmware and operating system components are legitimate, the flaw permits execution of unsigned or tampered code that would normally be prevented. The weakness is an improper access control flaw (CWE‑284). It does not provide a remote attack vector and is limited to users with local privileges, but an exploit could compromise boot integrity and elevate privileges or introduce persistent malware.

Affected workloads include Microsoft Windows 11 versions 24H2, 25H2, and 26H1 on both ARM64 and x64 architectures, as well as Windows Server 2025 with Server Core installations.

With a CVSS score of 7.9 the flaw is considered high severity. No EPSS score or KEV listing is available, indicating no widespread exploitation data yet. The attack vector is inferred to be local; an attacker must have access to the machine to modify boot configurations or firmware signatures. Once enabled, the vulnerability could allow the attacker to bypass Secure Boot checks, potentially leading to privilege escalation or persistent compromise.