The vulnerability is a protection mechanism failure in UEFI that lets an authorized user bypass a security feature locally. This flaw relates to improper safeguarding of security constraints (CWE‑693) and can allow the attacker to modify boot configuration or load unsigned code, thereby compromising the integrity of the operating system.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations.

The CVSS score of 7.8 indicates high severity. The EPSS score is not available, so exploitation likelihood is uncertain, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have local access to the system, and the exploit typically requires the ability to manipulate UEFI settings or certificates. Successful exploitation could enable the attacker to bypass Secure Boot, install malicious drivers or firmware, and effectively gain administrator‑level privileges on the affected machine.