The vulnerability involves improper authorization checks within Xbox Gaming Services that allow a local, authorized user to gain higher privileges on the same system. This is an elevation of privilege flaw, defined by CWE‑285, which can enable the attacker to access or modify data, execute restricted functions, or install additional software, potentially compromising system confidentiality, integrity, and availability. Attackers must already be authenticated or have local access; therefore the threat is confined to local environments rather than remote attacks.

Microsoft Xbox Gaming Services is affected. No specific version range is supplied, so the risk applies to all releases that have not yet been patched by Microsoft.

The CVSS score is 7.8, indicating a high severity local privilege escalation. The EPSS score is not available, so the current exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet have documented exploits in the wild. The likely attack vector involves a local user who is able to use the Xbox Gaming Services platform to bypass authorization controls and elevate their privileges.