The flaw is an untrusted search path in the Microsoft XML engine that permits an attacker to bypass a built‑in security feature by causing the processor to load a malicious DLL from an untrusted location. Because the XML component does not verify that the library originates from a trusted source, an attacker can trigger the execution of arbitrary code or increase privileges. The weakness is categorized as CWE‑426 and specifically affects environments that process XML through the Microsoft XML library.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations) are impacted. These releases are listed in Microsoft’s security advisory for CVE‑2026‑57097.

With a CVSS score of 6.4 the vulnerability is of moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of active exploitation. The flaw is not listed in the CISA KEV catalog. Based on the description the exploitation requires local, physical access to place a malicious DLL in an untrusted directory; network‑based delivery is not supported. Consequently the threat is confined to situations where an attacker can physically compromise the device.