The vulnerability is an untrusted search path flaw within the Windows Update component, allowing a local authorized user to place a malicious file in a location that Windows Update scans for updates. By doing so, the attacker can cause the update process to execute the malicious file with elevated privileges, effectively granting the user administrative or system-level access. This local privilege escalation can compromise confidentiality, integrity, and availability of the affected machine. The weakness is classified as CWE-426. Based on the description, it is inferred that the attacker can drop a file into the directory that Windows Update searches, thereby executing it with elevated privileges.

The flaw affects Microsoft Windows 11 (versions 23H2 through 26H2, including 26H1) and Windows Server 2025, on both x64 and arm64 architectures. All editions listed – 23H2, 24H2, 25H2, 26H2, 26H1 – are impacted. The issue resides in the Windows Update component across these OS releases.

The CVSS base score of 7.8 indicates a high severity local privilege escalation. The EPSS score is not available, but the lack of a listed KEV status does not diminish the risk; the exploit could be used in targeted attacks or to pivot from local accounts to privileged ones. The likely attack vector is local; an authorized user could manipulate the Windows Update search path by creating a malicious file in a trusted location that the update service automatically loads. Organizations should treat this as a critical patching priority.