The vulnerability is an improper link resolution before file access in Windows Update, allowing an authorized attacker with local privileges to elevate their rights. This flaw represents a file system relative path traversal (CWE‑59). It is limited to local privilege escalation; the CVE description does not claim that it leads to general system compromise.

Affected are Microsoft Windows 11 releases 23H2, 24H2, 25H2, 26H2 (x64 and arm64 where applicable) and 26H1, as well as all Windows Server 2025 installations—including Server Core and standard systems. All versions listed in the CNA vendor/product data are vulnerable.

The CVSS score is 7.8, indicating moderate to high severity. No EPSS score is available, and the vulnerability is not included in the CISA KEV catalog. The attack vector requires a user with local authentication to exploit the unsafe link resolution. If successfully exploited, the attacker could elevate privileges to a higher level, potentially SYSTEM, in a context where Windows Update processes are expected to run with trusted operations. Because the flaw is limited to local privilege escalation, the risk largely depends on user permissions and the execution context of the relevant processes.