An authorized local attacker can exploit a failure in the Windows Secure Boot protection mechanism, allowing them to bypass the Secure Boot security feature and load unsigned or tampered boot components. This undermines the integrity of the boot process and enables the attacker to install malicious code that resides at the lowest level of the system, potentially leading to persistent compromise of hardware and firmware.

Affected Microsoft products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; as well as Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025. The vulnerability applies across common processor architectures such as x86, x64, and arm64 where Secure Boot is configured.

The CVSS score of 7.9 indicates a high severity impact, but the EPSS score is not available, making the exact exploitation probability uncertain. The vulnerability is not currently listed in the CISA KEV catalog, suggesting limited or no confirmed exploitation. The likely attack vector is local, requiring physical or administrative access to the device; an attacker who can gain such access can manipulate the boot configuration to load malicious payloads before the operating system loads.