An improper resolution of path equivalence in the Windows Backup Engine allows an authorized user to elevate privileges locally. The flaw permits the construction of backup requests that reference files or directories outside the intended scope, enabling the execution of code with higher rights. This vulnerability is a medium‑to‑high severity flaw, reflected by a CVSS score of 7.8, and is related to CWE‑41, the incorrect handling of input data that can lead to unexpected behavior.

Microsoft Windows 10 (versions 21H2 and 22H2) and Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H2, and 26H1). The affected builds include x86, x64, and arm64 architectures as specified by the CNA product list.

The vulnerability is locally exploitable and requires an attacker to have authorized access to the system and the ability to invoke the Windows Backup Engine. It enables privilege escalation, potentially allowing a user to gain administrative rights. The absence of an EPSS score and lack of listing in the CISA KEV catalog suggests that widespread exploitation is not yet documented, but the high CVSS score indicates that remediation should be a priority. The attack vector is inferred to be local, relying on the exploitation of backup functionality by an authenticated user.