The vulnerability stems from a flaw in Windows Secure Boot that lets an authorized local attacker bypass the security controls normally enforced during system boot. This weakness is categorized as CWE-1329. By exploiting this weakness, the attacker could load unauthorized or unsigned system components, potentially escalating privileges or installing persistence mechanisms. Because the flaw operates at boot time, it undermines the integrity guarantees of the operating system.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1, and the corresponding Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 are affected. These include both standard and server‑core installations on x86, x64, ARM64, and related architectures as specified by the vendor's advisories.

The CVSS score of 7.9 highlights a‑severity weakness. The EPSS score is not available, but the vulnerability is not listed in CISA's KEV catalog, suggesting it is not a known exploited vulnerability yet. The attack vector is likely local, requiring the attacker to have some level of authorized access to the system; once the flaw is triggered, the attacker can compromise boot integrity and elevate privileges. Because Secure Boot is intended to defend against unauthorized code, this bypass threatens the foundational security of the Windows platform.