An attacker who can run Microsoft Windows Update processes normally can influence the file name or path used during update installation. By supplying a specially crafted path, the update components are written to arbitrary locations, allowing the attacker to override system files or place executable payloads. This local environment manipulation grants the attacker elevated privileges, enabling them to execute further code with administrative rights. The flaw is identified as CWE‑73, an external input controlling file paths.

Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1, as well as Windows Server 2025 (including the Server Core installation), are impacted. These systems receive the same Windows Update client that is vulnerable to the external path control scenario. The impact is confined to the user account that initiates the update process or any authorized local account with update permissions.

The CVSS score of 7.8 signals high severity. No EPSS score is available, so the likelihood of exploitation remains indeterminate. The vulnerability is not currently listed in CISA's KEV catalog, indicating no confirmed wide‑scale exploitation. Nonetheless, because the flaw relies on an authorized user and the Windows Update mechanism is widely used, the potential for local privilege escalation remains significant. The attack vector is local, requiring the attacker to be authenticated or to have the ability to trigger an update installation on the target machine.