The vulnerability is a NULL pointer dereference in the Windows Clipboard Server. This flaw allows an authorized local user to trigger the dereference, enabling the attacker to gain elevated privileges on the affected system. The weakness aligns with CWE‑476, which covers improper handling of null pointers leading to privilege escalation.

Microsoft Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server editions 2019, 2022, 2025, including Server Core installs.

The CVSS score of 7 indicates moderate severity, while the EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA KEV, implying no publicly known exploit at the time of the advisory. The attack vector is local and requires an authorized attacker; once exploited the attacker obtains higher privileges, which can be used to read or modify system state, install malware, or bypass security controls. Prompt patching is recommended.