Untrusted search path in the Windows Update component permits a locally authorized attacker to gain elevated privileges. The flaw arises when Update processes search for executables or resources in directories that can be manipulated by the user, allowing malicious binaries to be executed with higher rights. As a result, a user who can run programs on the machine may acquire kernel‑level or administrative privileges, enabling full control over the affected system.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, and Microsoft Windows Server 2025, including Windows Server 2025 Server Core installations. All listed flavors of Windows 11 for x64, ARM64, and corresponding 2025 server builds are affected.

The CVSS score of 7.8 identifies this as a high‑severity vulnerability. Because the exploit requires a local presence and an authorized user account, the EPSS score is not provided. The vulnerability is not listed in the CISA KEV catalog, which suggests no active exploitation has been reported. Nonetheless, the potential for privilege escalation warrants immediate remediation. A local attacker could authenticate to the machine and then exploit the search path weakness to run malicious code as SYSTEM, compromising data confidentiality, integrity, and availability.