The vulnerability is an improper authorization flaw (CWE-285) in Windows OLE that allows a local attacker with authorized access to elevate privileges on the affected operating systems.

Microsoft Windows 10, including versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 24H2, 25H2 and 26H1, are affected. The flaw also impacts Microsoft Windows Server releases 2012, 2012 R2, 2016, 2019, 2022 and 2025, covering both full and Server Core installations. The affected operating systems span both x86 and x64 architectures, delivering broad coverage across consumer and server environments.

The CVSS score of 7.8 indicates a high severity local privilege escalation risk; the EPSS score of less than 1% suggests a low probability of exploitation at this time and it is not listed in CISA’s KEV catalog. The most likely attack vector is a local attacker with authorized access; once the flaw is exploited, the attacker can run code with elevated privileges.