Improper access control in Windows Operating Systems allows an attacker who already has some level of local authorization to elevate privileges to higher levels.

The vulnerability affects several Windows releases: Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core). The affected builds run on x86, x64, and arm64 architectures.

The CVSS score of 7.8 indicates high severity for this local privilege escalation flaw. The EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation. Because the flaw requires local authorized access, the attack vector is local; an attacker must be present on the system or obtain basic user rights before exploitation can occur.