The vulnerability is an improper access control flaw in the Windows kernel that allows an attacker who already has local user credentials to gain SYSTEM privileges. This gives the attacker full control of the machine, enabling them to read, modify or delete any data; install or remove software; modify system settings; and maintain persistent footholds. The flaw is a direct result of CWE-284, where resource access checks are insufficient.

Affected Windows operating systems include Windows 10 version 21H2 and 22H2, Windows 11 versions 24H2, 25H2 and 26H1, and Windows Server 2022 and 2025, including Server Core installations products and are identified by the CPE strings supplied.

The CVSS score of 7.8 indicates a high‑severity vulnerability, and the EPSS score of 3% shows that the probability of exploitation in the near term is low but not negligible. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. The attack vector is local and requires an authorized user or local privilege. Successful exploitation would elevate the attacker to SYSTEM level, allowing complete control and the potential for data exfiltration, persistence, and malware installation.