Improper access control in the Windows Audio Compression Manager (ACM) allows an authorized local user to gain higher privileges on the system, potentially giving them full control over applications and data. This vulnerability is identified as CWE-284, an improper access control weakness that can lead to unauthorized privilege escalation. The impact is limited to the local scope: an attacker who can log in or otherwise authenticate to the machine may elevate their privileges to that of the operating system.

The flaw affects a broad range of Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025 (both full and Server Core installations). All of these operating systems contain the vulnerable ACM component that can be exploited to perform local privilege escalation.

The CVSS score of 7.8 indicates a high severity for privilege escalation, while the moderate EPSS score of 3% suggests that exploitation is plausible but not highly probable in the wild. Since the attack is local and requires an authorized user or a compromised account, the threat is primarily internal. The vulnerability is not currently listed in the CISA KEV catalog, meaning no widespread, publicly available exploit has been detected at this time.