The vulnerability originates from improper privilege management within Windows WalletService, classified as CWE-269 and CWE-59. It permits a local user who has already gained authenticated access to elevate their privileges. The impact is the ability to obtain administrative rights on the affected machine, exfiltration, or installation of malware. Based on the description, it is inferred that the likely attack vector is a local attacker who already holds user‑level access, who can then manipulate WalletService to increase privileges.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; Microsoft Windows Server 2016 (including Server Core), 2019 (including Server Core), 2022, and 2025 (including Server Core).

The CVSS score of 7.8 indicates high severity for a local privilege escalation, but the EPSS score of <1% shows a very low probability of abuse in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need local authorized access to manipulate WalletService; from that position they could obtain administrative privileges and subsequently install malware or alter system configuration. Given the low exploitation likelihood, monitoring for privileged activity remains prudent until the official patch is applied.