A command‑injection flaw in the Windows Update component allows a local attacker who already has a user‐level session to execute arbitrary system commands, thereby escalating privileges to administrative level. This vulnerability, scored at 7.8 on the CVSS scale, permits full compromise of the local machine from the attacker's standpoint, with no remote or network‑based requirements disclosed.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2025 (including Server Core). The flaw exists in both x64 and ARM64 builds of the specified Windows 11 releases.

The CVSS base score of 7.8 indicates high severity, but no EPSS value is available, so the precise likelihood of exploitation remains uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploits in the wild as of the last assessment. The attack vector is inferred to be local, requiring an authenticated user or sandboxed process; the description confirms command injection as the weakness, matching CWE‑77. The absence of external, remote exploitation details means defense is primarily focused on preventing unauthorized local access and ensuring the update is applied.