The vulnerability arises from improper link resolution before file access in the Windows Container Manager Service. This flaw, identified as CWE‑59, enables an attacker who already has local system‑access privileges to bypass a security feature that protects container configuration files, potentially giving unauthorized access to resources normally restricted by that feature.

The flaw affects Microsoft Windows 11 releases 23H2, 24H2, 25H2, and 26H1 on both x64 and arm64 architectures, as listed in the Vendor's advisory.

The calculated CVSS score of 4.7 indicates moderate risk, and no EPSS data is currently available. The vulnerability is not listed in CISA's KEV catalog. Because exploitation requires local authorization, the attack vector is limited to the infected host; however, once the local attacker gains sufficient privileges, the feature bypass could assist in escalating or persisting. The lack of a publicly known exploit or broad distribution reduces immediate threat.