The vulnerability arises from an untrusted search path in the Windows Update Service that allows a local, authorized attacker to elevate privileges. An attacker who can run code on the machine can exploit improperly ordered search directories, causing the system to load a malicious update or executable with elevated privileges. This can lead to full control over the affected Windows system, allowing compromise of sensitive data, installation of malware, or assertion of administrative rights. The weakness is a classic CWE-426 scenario where the operating system fails to prevent execution of files from untrusted directories.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2025 (including Server Core installations)."""

The CVSS score of 7.8 indicates a high severity for local escalation. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting that it is not currently known to be actively exploited in the wild. The attack vector is local: an attacker with physical or administrative access to the host can trigger the untrusted search path condition. The impact is thus confined to systems where the attacker can execute code locally, but once inside, they can gain elevated privileges and potentially compromise the entire machine.