The vulnerability is an improper verification of a cryptographic signature in Windows Key Distribution Center (KDC) that allows an authorized attacker with local access to elevate privileges. Because the flaw lies in KDC's trust evaluation of signed data, a tampered or forged signature can be accepted, granting the attacker elevated permissions on the host. This represents a local privilege escalation that could let the attacker execute arbitrary code, install software, or compromise the entire system once executed.

Affected systems include Windows 10 starting with version 1607 through 1809, Windows 11 versions 24H2, 25H2, 26H2, and 26H1, and a range of Windows Server editions from 2012 to 2025, including core installations. All identified builds support x86, x64, and arm64 architectures as listed.

The CVSS score of 7.8 indicates a high severity vulnerability, but the EPSS score is not available, so the current exploitation probability cannot be measured. The flaw is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation. The attack requires local authorized access; an attacker must possess a user account or be able to run code with enough privileges to manipulate the KDC data. The likely attack vector is local with an authorized user, and no remote access is required. If successful, the elevated rights allow full control over the target machine.