The vulnerability stems from a failure of Secure Boot protection mechanisms, enabling an authorized local attacker to bypass the Secure Boot feature. The attacker can load and execute unsigned firmware or boot code, thereby undermining boot integrity and potentially facilitating further malicious activity. This constitutes an authorization bypass (CWE‑284) and compromises the confidentiality, integrity, and availability of the system.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1; and Microsoft Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both core and full installations).

With a CVSS score of 7.9, the vulnerability is considered high severity. No EPSS score is provided, so the exploitation likelihood is uncertain; however, the local and authorized nature of the attack reduces the broader threat compared to remote exploits. The vulnerability is not listed in the CISA KEV catalog, indicating no widely known commercial exploitation at present.