The Vulnerability in Windows Cross Device Service permits a local attacker with an authorized account to elevate privileges, allowing them to gain higher permissions than intended. This improper access control flaw corresponds to the CWE-284 weakness, where authority checks are insufficient and can be bypassed. The impact of successful exploitation is the ability to run code with elevated rights, potentially compromising the entire system security posture.

Affected systems include Microsoft Windows 10 22H2 and Microsoft Windows 11 versions 24H2, 25H2, and 26H1. These versions run on x64 or arm64 architectures. Any installation of these operating systems is vulnerable until a patch is applied.

The CVSS score of 7.8 indicates a moderate to high severity, and the EPSS score of 5% suggests a low but non-negligible exploitation likelihood. The vulnerability is not currently listed in the CISA KEV catalog. The probable attack vector involves a local, authorized attacker using the Cross Device Service, which can be abused to increase privileges on the host. Successful exploitation requires only local access and does not rely on remote network attack, making it potentially easier for insiders or malicious users with physical access.