The vulnerability arises from a type‑confusion flaw in Windows SmartScreen. An authorized attacker can engage SmartScreen with a resource whose type is incompatible, causing the system to treat the data as an unexpected type. This permits the attacker to gain higher privileges on the local machine. The issue is an example of CWE‑843, affecting the confidentiality, integrity, and availability of the host.

Microsoft Windows 10 versions 1809, 21H2 and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2019, 2022 and 2025, including all Server‑Core installations. All affected releases include the vulnerable SmartScreen component.

The CVSS score of 7.8 classifies this as a high severity local privilege escalation. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so the current likelihood of exploitation is unknown. Because the flaw requires an attacker to be authorized on the target system or to execute code locally, the typical attack scenario involves compromised user credentials or local malware. Once the type‑confusion is triggered, the attacker can run actions with elevated rights, potentially taking full control of the device.