The vulnerability is an improper resource shutdown or release in Windows UEFI that allows an authorized local attacker to bypass the Secure Boot security feature. This defers the enforcement of firmware integrity checks meant to prevent unsigned code from loading during boot.

Affected systems include Microsoft Windows 10 Builds 1607, 1809, 21H2, and 22H2; Windows 11 Builds 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations).

The CVSS score of 7.8 indicates high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires local authorization, the threat is limited to users who already have access to the system; however, once bypassing Secure Boot, the attacker could load unsigned firmware or drivers.