The vulnerability is caused by an out‑of‑bounds read in the SQLite component that is embedded in Windows. An attacker who can execute code on the local machine can trigger the read and gain elevated privileges. This allows the attacker to perform actions that normally require higher authorization, compromising confidentiality, integrity, and availability of the system. The weakness is identified as CWE‑125, a memory error that can be abused for privilege escalation.

The flaw affects Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; and Windows Server editions 2016, 2019, 2022 and 2025, including both standard and Server Core installations. CPE data confirm that the vulnerability exists on x86, x64 and arm64 architectures where SQLite is used.

The CVSS base score of 7.8 classifies the issue as moderate‑to‑high severity. EPSS data are not available and the vulnerability is not yet listed in the CISA KEV catalog, but it can be exploited by a local, authorized user—such as a developer or system administrator—to gain elevated privileges. No remote access or additional software is required, so the attack surface is narrow yet real on all affected systems. Immediate patching is therefore recommended.