The flaw is an improperly executed security check within the Windows Secure Boot chain. An attacker who already has local authorization privileges can exploit this weakness to bypass the Secure Boot protection, allowing unsigned or malicious firmware and OS components to be loaded as if they were legitimate. The consequence is an elevation of privilege that compromises the integrity of the boot process and can enable the execution of unauthorized code at a high privilege level. The weakness is classified as CWE‑358, which involves security checks that are incorrectly performed.

Microsoft Windows 10 (Version 1607, 1809, 21H2, 22H2), Windows 11 (Version 24H2, 25H2, 26H1), and Microsoft Windows Server 2016, 2019, 2022, 2025 (including Server Core installations) are reported to be affected. No further version granularity is provided beyond what is listed.

The CVSS score of 7.8 indicates high severity, yet the EPSS score of less than 1% shows a very low probability of exploitation at the time of analysis. The vulnerability is not included in the CISA KEV catalog. The likely attack path requires local persistence or administrative rights to manipulate boot configuration, after which the attacker can introduce malicious firmware or drivers that the system will load without verification.