This vulnerability in Windows Certificates involves an untrusted pointer dereference that lets an authorized attacker execute actions with elevated privileges. The weakness, identified as CWE‑822, permits a local user to gain higher-level access through the certificate service, potentially compromising system integrity and confidentiality.

Affected products include Microsoft Windows 10 from versions 1607 through 22H2, Microsoft Windows 11 from versions 23H2 through 26H2 (including 26H1), and Microsoft Windows Server 2012 R2 through Server 2025, including server‑core installations. The issue is present on both x86 and x64 architectures as well as arm64 in recent Windows 11 releases.

The CVSS score of 7.8 points to a high severity local exploitation scenario. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is an authorized local user with sufficient access to run code that interacts with the certificate service. This restriction reduces the overall risk relative to remote exploits but still allows any authenticated user to elevate privileges on the affected systems.