The vulnerability in Microsoft PowerShell stems from incorrect default permissions that allow an authorized local user to elevate privileges. This issue is classified as a CWE-276 weakness involving improper authorization. An attacker who is already authorized locally can use the elevated permissions to execute actions that typically require higher privileges, potentially compromising system confidentiality, integrity, and availability.

Microsoft PowerShell, versions 7.4, 7.5 and 7.6 are affected. The vulnerability compromises the default file and directory permissions associated with the PowerShell executable, allowing local users with any authorizations to gain elevated system rights.

With a CVSS score of 7.3, the vulnerability is considered high severity. The EPSS score is not available, but the lack of a KEV listing suggests that no known exploits exist publicly. The attack vector is local, requiring an attacker with some level of local authorization; once exploited, the attacker can assume higher privileges and potentially compromise the entire system.