The vulnerability is a protection mechanism failure in Windows Secure Boot that permits an authorized local attacker to bypass the secure boot feature. This weakness is classified under CWE‑1329, which involves an attacker manipulating input parameters to subvert a security state. By bypassing secure boot, the attacker could load unsigned drivers or firmware, undermining the integrity of the system boot process and potentially compromising confidentiality and integrity of the machine.

Affected systems include multiple Microsoft Windows client and server releases. Client versions: Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H1 (ARM64 and x86/x64 as applicable). Server releases: Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (both Standard and Server Core installations).

The CVSS score of 7.9 indicates high severity, but the EPSS score is not available, leaving the likelihood of exploitation uncertain. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires local authorized privileges; an attacker must have a user account that can modify UEFI settings or run code that can interact with the Secure Boot configuration. Bypassing secure boot locally could grant an attacker continuous access to execute malicious code with elevated privileges, presenting a serious long‑term compromise risk. Organisers should monitor for any elevation of privilege or unexpected driver load events.