Windows Kerberos includes an integer underflow flaw (wrap or wraparound) that can be triggered by an authorized local attacker, allowing elevation of privileges on the affected system. The vulnerability is rooted in a faulty wraparound calculation and is classified as CWE‑191. It permits a user who can authenticate to the local machine to increase their privileges, potentially compromising system security and data integrity.

Microsoft reports that Windows 10 releases 1607, 1809, 21H2, and 22H2, Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including server core installations) are vulnerable. These versions are identified by Microsoft, and detailed build information can be found in the update catalog.

The CVSS score of 7.8 indicates a high severity for local privilege escalation. EPSS is less than 1%, showing a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers require legitimate local access and the ability to authenticate via Kerberos. While no public exploitation has been documented, systems exposed to local attackers remain at risk until the update is applied.