The flaw stems from an incorrect authorization check within Windows Hello, permitting an attacker who has already authenticated locally to bypass a protected security feature. This does not allow remote exploitation or elevation to higher privilege levels on its own, but it can undermine the integrity of biometric or PIN verification that protects local resources.

This vulnerability affects Microsoft Windows 10 release 21H2 and 22H2 as well as Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1. All of these are listed as potentially impacted, whether they run on x86, x64, or arm64 architectures.

The CVSS score is 4.4, placing it in medium severity range, and the EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the most likely attack vector involves a local attacker who has already authenticated; there are no network-facing entry points. The lack of remote exposure combined with the moderate severity and low exploitation probability reduces overall attractiveness, but the issue still warrants confirmation in affected environments.